diff --git a/.gitignore b/.gitignore index 64c3d6ec3..88761d7af 100644 --- a/.gitignore +++ b/.gitignore @@ -3,3 +3,4 @@ public services/amba-alerts* artifacts/*/** +/.vs diff --git a/docs/content/patterns/alz/Bring-your-own-Managed-Identity.md b/docs/content/patterns/alz/Available_features/Bring-your-own-Managed-Identity.md similarity index 63% rename from docs/content/patterns/alz/Bring-your-own-Managed-Identity.md rename to docs/content/patterns/alz/Available_features/Bring-your-own-Managed-Identity.md index 0a33159b6..2a41ec11c 100644 --- a/docs/content/patterns/alz/Bring-your-own-Managed-Identity.md +++ b/docs/content/patterns/alz/Available_features/Bring-your-own-Managed-Identity.md @@ -1,12 +1,12 @@ --- -title: Bring Your Own User Assigned Managed Identity (BYO UAMI) +title: Bring Your Own User Assigned Managed Identity geekdocCollapseSection: true -weight: 62 +weight: 95 --- # Overview -The ***Bring Your Own User Assigned Managed Identity*** (BYO UAMI) feature, available with release [2024-06-05](../Whats-New#2024-06-05), allows both Greenfield and Brownfield customers to create a new User Assigned Managed Identity (UAMI) during the deployment of AMBA-ALZ. It also allows Brownfield customers, who deployed the ALZ pattern when this feature wasn't available, to use any existing one by configuring a couple of parameters. Thanks to this new feature, it's now possible to query Azure Resource Graph (ARG) using the Kusto Query Language. Log-based search alerts can now be enhanced to include ARG queries looking at resource tags. +The ***Bring Your Own User Assigned Managed Identity*** (BYO UAMI) feature, available with release [2024-06-05](../../Whats-New#2024-06-05), allows both Greenfield and Brownfield customers to create a new User Assigned Managed Identity (UAMI) during or after the deployment of AMBA-ALZ. It also allows Brownfield customers, who deployed the ALZ pattern when this feature wasn't available, to use any existing one by configuring a couple of parameters. Thanks to this new feature, it's now possible to query Azure Resource Graph (ARG) using the Kusto Query Language. Log-based search alerts can now be enhanced to include ARG queries looking at resource tags. # How this feature works @@ -23,7 +23,10 @@ The deployment template has conditions that controls what is being deployed acco A. ***Customers want to use existing UAMI.*** In this scenario the deployment will: {{< hint type=Important >}} -When using an existing UAMI provided by the customer, the customer has to grant the UAMI the ***Monitoring Reader*** role at the pseudo root Management Group level **before running the deployment.** +Before executing the deployment, ensure that the existing UAMI is assigned the ***Monitoring Reader*** role at the pseudo root Management Group. + +It is probable that the UAMI you provide is located within the Management subscription beneath the Platform management group, whereas the Policy Assignment resides at the LandingZones management group. In this case, for the deployIfNotExists policies to have permission to assign the UAMI to the scheduled query rule, the ***Managed Identity Operator*** role must be granted to the system Managed Identity of the Initiative Assignment (```Deploy-AMBA-VM``` for the Virtual machine initiative, ```Deploy-AMBA-HybridVM``` for the Arc-enabled Servers initiative) at the UAMI scope. + {{< /hint >}} - Not deploy any UAMI @@ -32,7 +35,7 @@ When using an existing UAMI provided by the customer, the customer has to grant Here's a sample extract of the parameter file with the relevant parameter configuration for this scenario: - ![Customer defined UAMI](../media/alz-UAMI-Param-Example-1.png) + ![Customer defined UAMI](../../media/alz-UAMI-Param-Example-1.png) B. ***Customers does not have an existing UAMI and want AMBA-ALZ to create a new one.*** In this scenario the deployment will: @@ -46,13 +49,13 @@ When a new UAMI is created by the deployment template, the ***Monitoring Reader* Here's a sample extract of the parameter file with the relevant parameter configuration for this scenario: - ![New UAMI deployed by the template](../media/alz-UAMI-Param-Example-2.png) + ![New UAMI deployed by the template](../../media/alz-UAMI-Param-Example-2.png) ## Where is it used This new feature is used in Log-search based alerts. At the moment of this release, there's one alert using it. The alert is part of the new ***Deploy Azure Monitor Vaseline Alerts for Hybrid VMs*** policySet added to monitor hybrid virtual machine. -![Deploy Azure Monitor Baseline Alerts for Hybrid VMs](../media/deploy-HybridVM-Alerts.png) +![Deploy Azure Monitor Baseline Alerts for Hybrid VMs](../../media/deploy-HybridVM-Alerts.png) {{< hint type=Info >}} We're planning to use this feature more in the future and to include it as part of other alerts. @@ -60,11 +63,11 @@ We're planning to use this feature more in the future and to include it as part ## Switching between BYO UAMI and new UAMI -The [conditional deployment behavior](../alz/Bring-your-own-Managed-Identity.md#conditional-deployment-behavior) discussed earlier, allows brownfield customers to switch from a new created UAMI to an existing one and viceversa. +The [conditional deployment behavior](../../Available_features/Bring-your-own-Managed-Identity#conditional-deployment-behavior) discussed earlier, allows brownfield customers to switch from a new created UAMI to an existing one and viceversa. Should customers decide to switch, it will be enough to: - Change the values in the parameter file to match one of the two scenarios previously discussed - Redeploy the AMBA-ALZ pattern -- Run the remediation for the [Deploy Azure Monitor Baseline Alerts for Hybrid VMs](https://raw.githubusercontent.com/Azure/azure-monitor-baseline-alerts/main/patterns/alz/policySetDefinitions/Deploy-HybridVM-Alerts.json) policy initiative as documented at [Remediate Policies](../deploy/Remediate-Policies) +- Run the remediation for the [Deploy Azure Monitor Baseline Alerts for Hybrid VMs](https://raw.githubusercontent.com/Azure/azure-monitor-baseline-alerts/main/patterns/alz/policySetDefinitions/Deploy-HybridVM-Alerts.json) policy initiative as documented at [Remediate Policies](../../deploy/Remediate-Policies) The code will reconfigure the necessary alerts to use either the customer's provided UAMI or the new one created during the deployment. diff --git a/docs/content/patterns/alz/Bring-your-own-Notifications.md b/docs/content/patterns/alz/Available_features/Bring-your-own-Notifications.md similarity index 69% rename from docs/content/patterns/alz/Bring-your-own-Notifications.md rename to docs/content/patterns/alz/Available_features/Bring-your-own-Notifications.md index 4d274df7d..426dc5b78 100644 --- a/docs/content/patterns/alz/Bring-your-own-Notifications.md +++ b/docs/content/patterns/alz/Available_features/Bring-your-own-Notifications.md @@ -1,12 +1,12 @@ --- -title: Bring Your Own Notifications (BYON) +title: Bring Your Own Notifications geekdocCollapseSection: true -weight: 61 +weight: 100 --- # Overview -The ***Bring Your Own Notifications*** (BYON) feature, available with release [2024-04-12](../Whats-New#2024-04-12), allows brownfield customers to use their existing Action Groups (also known as AGs) and Alert Processing Rule (also known as APR) not forcing the use of notification assets deployed by both the [Notification Assets](https://raw.githubusercontent.com/Azure/azure-monitor-baseline-alerts/main/patterns/alz/policySetDefinitions/Deploy-Notification-Assets.json) initiative and the [Deploy Service Health Action Group](https://raw.githubusercontent.com/Azure/azure-monitor-baseline-alerts/main/services/Resources/subscriptions/Deploy-ServiceHealth-ActionGroups.json) policy definition present in the ALZ pattern. It also allows Brownfield customer who deployed the ALZ pattern when this feature wasn't available, to switch to it. +The ***Bring Your Own Notifications*** (BYON) feature, available with release [2024-04-12](../../Whats-New#2024-04-12), allows brownfield customers to use their existing Action Groups (also known as AGs) and Alert Processing Rule (also known as APR) not forcing the use of notification assets deployed by both the [Notification Assets](https://raw.githubusercontent.com/Azure/azure-monitor-baseline-alerts/main/patterns/alz/policySetDefinitions/Deploy-Notification-Assets.json) initiative and the [Deploy Service Health Action Group](https://raw.githubusercontent.com/Azure/azure-monitor-baseline-alerts/main/services/Resources/subscriptions/Deploy-ServiceHealth-ActionGroups.json) policy definition present in the ALZ pattern. It also allows Brownfield customer who deployed the ALZ pattern when this feature wasn't available, to switch to it. # How this feature works @@ -14,11 +14,11 @@ The BYON feature works by setting the necessary parameter values before running Should Brownfield customers decide to use their own notification assets, it will be sufficient to enter the _AG resource IDs_ (separated by comma) and the _APR resource ID_ values in the respective parameters ***BYOActionGroup*** and ***BYOAlertProcessingRule***, leaving the ***ALZMonitorActionGroupEmail***, ***ALZLogicappResourceId***, ***ALZLogicappCallbackUrl***, ***ALZArmRoleId***, ***ALZEventHubResourceId***, ***ALZWebhookServiceUri***, ***ALZFunctionResourceId*** and ***ALZFunctionTriggerUrl*** ***with no values***: - ![policyAssignmentParametersBYON section](../../alz/media/BYON_Params.png) + ![policyAssignmentParametersBYON section](../../media/BYON_Params.png) Differently if they decide to use the assets provided by AMBA or if they're Greenfield customers, they'll just leave the ***BYOActionGroup*** and ***BYOAlertProcessingRule*** parameters with no values and populate all the others (***ALZMonitorActionGroupEmail***, ***ALZLogicappResourceId***, ***ALZLogicappCallbackUrl***, ***ALZArmRoleId***, ***ALZEventHubResourceId***, ***ALZWebhookServiceUri***, ***ALZFunctionResourceId*** and ***ALZFunctionTriggerUrl***): -![policyAssignmentParametersNotificationAssets section](../../alz/media/NotificationAssets_Params.png) +![policyAssignmentParametersNotificationAssets section](../../media/NotificationAssets_Params.png) ## Conditional deployment behavior @@ -32,7 +32,7 @@ A. ***Use your own AGs with the AMBA APR***. In this scenario, the deployment wi Here's an example of the parameter file with the relevant sections populated for this scenario: -![policyAssignmentParametersBYON section](../../alz/media/BYON_Params_2.png) +![policyAssignmentParametersBYON section](../../media/BYON_Params_2.png) B. ***Use your own AGs and APR***. In this scenario, the deployment will: @@ -41,7 +41,7 @@ B. ***Use your own AGs and APR***. In this scenario, the deployment will: Here's an example of the parameter file with the relevant sections populated for this scenario: -![policyAssignmentParametersBYON section](../../alz/media/BYON_Params_3.png) +![policyAssignmentParametersBYON section](../../media/BYON_Params_3.png) C. ***Use AMBA notification assets***. In this scenario, the deployment will: @@ -49,11 +49,12 @@ C. ***Use AMBA notification assets***. In this scenario, the deployment will: Here's an example of the parameter file with the relevant sections populated for this scenario: -![policyAssignmentParametersNotificationAssets section](../../alz/media/NotificationAssets_Params_2.png) +![policyAssignmentParametersNotificationAssets section](../../media/NotificationAssets_Params_2.png) ## Switching between BYON and Notification Assets -The [conditional deployment behavior](../../alz/Bring-your-own-Notifications#conditional-deployment-behavior) discussed earlier, allows brownfield customers to switch from the initial notification assets scenario (the only one available until release [2024-03-01](../../alz/Whats-New#2024-03-01)) to the new BYON after deployment and viceversa. +The [conditional deployment behavior](../../Bring-your-own-Notifications#conditional-deployment-behavior) discussed earlier, allows brownfield customers to switch from the initial notification assets scenario (the only one available until release [2024-03-01](../../Whats-New#2024-03-01)) to the new BYON after deployment and viceversa. + Should customers decide to switch, it will be enough to: - change the values in the parameter file to match one of the three cases previously discussed diff --git a/docs/content/patterns/alz/Available_features/Log_Search_Alert_Table.md b/docs/content/patterns/alz/Available_features/Log_Search_Alert_Table.md new file mode 100644 index 000000000..7d20008bf --- /dev/null +++ b/docs/content/patterns/alz/Available_features/Log_Search_Alert_Table.md @@ -0,0 +1,31 @@ +--- +title: Log-search alert table +geekdocHidden: true +--- + +| Resource Type | Alert Name | Alert Type | Override Tag name | +| ------------- | ---------- | ---------- | ----------------- | +| Machine - Azure Arc | *```subscription().displayName```*-HybridVMHighDataDiskReadLatencyAlert | _Log search_ | ***\_amba-ReadLatencyMs-Data-threshold-override\_*** | +| Machine - Azure Arc | *```subscription().displayName```*-HybridVMLowDataDiskSpaceAlert | _Log search_ | ***\_amba-FreeSpacePercentage-Data-threshold-override\_*** | +| Machine - Azure Arc | *```subscription().displayName```*-HybridVMHighDataDiskWriteLatencyAlert | _Log search_ | ***\_amba-WriteLatencyMs-Data-threshold-override\_*** | +| Machine - Azure Arc | *```subscription().displayName```*-HybridVMDisconnectedAlert | _Log search_ | ***\_amba-Disconnected-threshold-override\_*** | +| Machine - Azure Arc | *```subscription().displayName```*-HybridVMHeartBeatAlert | _Log search_ | ***\_amba-Heartbeat-threshold-override\_*** | +| Machine - Azure Arc | *```subscription().displayName```*-HybridVMHighNetworkInAlert | _Log search_ | ***\_amba-ReadBytesPerSecond-threshold-override\_*** | +| Machine - Azure Arc | *```subscription().displayName```*-HybridVMHighNetworkOutAlert | _Log search_ | ***\_amba-WriteBytesPerSecond-threshold-override\_*** | +| Machine - Azure Arc | *```subscription().displayName```*-HybridVMHighOSDiskReadLatencyAlert | _Log search_ | ***\_amba-ReadLatencyMs-OS-threshold-override\_*** | +| Machine - Azure Arc | *```subscription().displayName```*-HybridVMLowOSDiskSpaceAlert | _Log search_ | ***\_amba-FreeSpacePercentage-OS-threshold-override\_*** | +| Machine - Azure Arc | *```subscription().displayName```*-HybridVMHighOSDiskWriteLatencyAlert | _Log search_ | ***\_amba-WriteLatencyMs-OS-threshold-override\_*** | +| Machine - Azure Arc | *```subscription().displayName```*-HybridVMHighCPUAlert | _Log search_ | ***\_amba-UtilizationPercentage-threshold-override\_*** | +| Machine - Azure Arc | *```subscription().displayName```*-HybridVMLowMemoryAlert | _Log search_ | ***\_amba-AvailableMemoryPercentage-threshold-override\_*** | +| Virtual machine | *```subscription().displayName```*-VMHighDataDiskReadLatencyAlert | _Log search_ | ***\_amba-ReadLatencyMs-Data-threshold-override\_*** | +| Virtual machine | *```subscription().displayName```*-VMLowDataDiskSpaceAlert | _Log search_ | ***\_amba-FreeSpacePercentage-Data-threshold-override\_*** | +| Virtual machine | *```subscription().displayName```*-VMHighDataDiskWriteLatencyAlert | _Log search_ | ***\_amba-WriteLatencyMs-Data-threshold-override\_*** | +| Virtual machine | *```subscription().displayName```*-VMHeartBeatAlert | _Log search_ | ***\_amba-Heartbeat-threshold-override\_*** | +| Virtual machine | *```subscription().displayName```*-VMHighNetworkInAlert | _Log search_ | ***\_amba-ReadBytesPerSecond-threshold-override\_*** | +| Virtual machine | *```subscription().displayName```*-VMHighNetworkOutAlert | _Log search_ | ***\_amba-WriteBytesPerSecond-threshold-override\_*** | +| Virtual machine | *```subscription().displayName```*-VMHighOSDiskReadLatencyAlert | _Log search_ | ***\_amba-ReadLatencyMs-OS-threshold-override\_*** | +| Virtual machine | *```subscription().displayName```*-VMLowOSDiskSpaceAlert | _Log search_ | ***\_amba-FreeSpacePercentage-OS-threshold-override\_*** | +| Virtual machine | *```subscription().displayName```*-VMHighOSDiskWriteLatencyAlert | _Log search_ | ***\_amba-WriteLatencyMs-OS-threshold-override\_*** | +| Virtual machine | *```subscription().displayName```*-VMHighCPUAlert | _Log search_ | ***\_amba-UtilizationPercentage-threshold-override\_*** | +| Virtual machine | *```subscription().displayName```*-VMLowMemoryAlert | _Log search_ | ***\_amba-AvailableMemoryPercentage-threshold-override\_*** | +| Log Analytics workspace | *```resourceName```*-DailyCapLimitReachedAlert | _Log search_ | ***Not available since threshold will always be ```0```*** | diff --git a/docs/content/patterns/alz/Available_features/Metrics_Alert_Table.md b/docs/content/patterns/alz/Available_features/Metrics_Alert_Table.md new file mode 100644 index 000000000..0af9d5640 --- /dev/null +++ b/docs/content/patterns/alz/Available_features/Metrics_Alert_Table.md @@ -0,0 +1,95 @@ +--- +title: Metrics alert table +geekdocHidden: true +--- + +| Resource Type | Alert Name | Alert Type | Override Tag name | +| ------------- | ---------- | ---------- | ----------------- | +| Virtual machine | *```resourceName```*-AvailableMemoryAlert | Metrics | ***\_amba-AvailableMemoryBytes-threshold-override\_*** | +| Automation Account | *```resourceName```*-TotalJob | Metrics | ***\_amba-TotalJob-threshold-override\_*** | +| Front Door and CDN profile | *```resourceName```*-OriginHealthPercentage | Metrics | ***\_amba-OriginHealthPercentage-threshold-override\_*** | +| Front Door and CDN profile | *```resourceName```*-OriginLatencyAlert | Metrics | ***Not available since it uses dynamic thresholds*** | +| Front Door and CDN profile | *```resourceName```*-Percentage4XXAlert | Metrics | ***Not available since it uses dynamic thresholds*** | +| Front Door and CDN profile | *```resourceName```*-Percentage5XXAlert | Metrics | ***Not available since it uses dynamic thresholds*** | +| Key vault | ActivityKeyVaultDelete | Activity Log | ***Not available since Activity Log based alerts do not have thresholds*** | +| Key vault | *```resourceName```*-Availability | Metrics | ***\_amba-Availability-threshold-override\_*** | +| Key vault | *```resourceName```*-CapacityAlert | Metrics | ***\_amba-SaturationShoebox-threshold-override\_*** | +| Key vault | *```resourceName```*-LatencyAlert | Metrics | ***\_amba-ServiceApiLatency-threshold-override\_*** | +| Key vault | *```resourceName```*-RequestsAlert | Metrics | ***Not available since it uses dynamic thresholds*** | +| Azure Key Vault Managed HSM | ActivityManagedHSMDelete | Activity Log | ***Not available since Activity Log based alerts do not have thresholds*** | +| Azure Key Vault Managed HSM | *```resourceName```*-Availability | Metrics | ***\_amba-Availability-threshold-override\_*** | +| Azure Key Vault Managed HSM | *```resourceName```*-LatencyAlert | Metrics | ***\_amba-ServiceApiLatency-threshold-override\_*** | +| Application gateway | *```resourceName```*-agApplicationGatewayTotalTime | Metrics | ***Not available since it uses dynamic thresholds*** | +| Application gateway | *```resourceName```*-agBackendLastByteResponseTime | Metrics | ***Not available since it uses dynamic thresholds*** | +| Application gateway | *```resourceName```*-agCapacityUnits | Metrics | ***\_amba-CapacityUnits-threshold-override\_*** | +| Application gateway | *```resourceName```*-agComputeUnits | Metrics | ***\_amba-ComputeUnits-threshold-override\_*** | +| Application gateway | *```resourceName```*-agCpuUtilization | Metrics | ***\_amba-CpuUtilization-threshold-override\_*** | +| Application gateway | *```resourceName```*-agFailedRequests | Metrics | ***Not available since it uses dynamic thresholds*** | +| Application gateway | *```resourceName```*-agResponseStatus | Metrics | ***Not available since it uses dynamic thresholds*** | +| Application gateway | *```resourceName```*-agUnhealthyHostCount | Metrics | ***\_amba-UnhealthyHostCount-threshold-override\_*** | +| Firewall | ActivityAzureFirewallDelete | Activity Log | ***Not available since Activity Log based alerts do not have thresholds*** | +| Firewall | *```resourceName```*-FirewallHealth | Metrics | ***\_amba-FirewallHealth-threshold-override\_*** | +| Firewall | *```resourceName```*-SNATPortUtilization | Metrics | ***\_amba-SNATPortUtilization-threshold-override\_*** | +| ExpressRoute circuit | *```resourceName```*-ArpAvailability | Metrics | ***\_amba-ArpAvailability-threshold-override\_*** | +| ExpressRoute circuit | *```resourceName```*-BgpAvailability | Metrics | ***\_amba-BgpAvailability-threshold-override\_*** | +| ExpressRoute circuit | *```resourceName```*-QosDropBitsInPerSecond | Metrics | ***Not available since it uses dynamic thresholds*** | +| ExpressRoute circuit | *```resourceName```*-QosDropBitsOutPerSecond | Metrics | ***Not available since it uses dynamic thresholds*** | +| ExpressRoute gateway | *```resourceName```*-GatewayERBitsInAlert | Metrics | ***\_amba-ERGatewayConnectionBitsInPerSecond-threshold-override\_*** | +| ExpressRoute gateway | *```resourceName```*-GatewayERBitsOutAlert | Metrics | ***\_amba-ERGatewayConnectionBitsOutPerSecond-threshold-override\_*** | +| ExpressRoute gateway | *```resourceName```*-GatewayERCPUAlert | Metrics | ***\_amba-ExpressRouteGatewayCpuUtilization-threshold-override\_*** | +| ExpressRoute port | *```resourceName```*-DirectERBitsInAlert | Metrics | ***\_amba-PortBitsInPerSecond-threshold-override\_*** | +| ExpressRoute port | *```resourceName```*-DirectERBitsOutAlert | Metrics | ***\_amba-PortBitsOutPerSecond-threshold-override\_*** | +| ExpressRoute port | *```resourceName```*-DirectERLineProtocolAlert | Metrics | ***\_amba-LineProtocol-threshold-override\_*** | +| ExpressRoute port | *```resourceName```*-DirectERRxLightLevelHighAlert | Metrics | ***\_amba-RxLightLevel-High-threshold-override\_*** | +| ExpressRoute port | *```resourceName```*-DirectERRxLightLevelLowAlert | Metrics | ***\_amba-RxLightLevel-Low-threshold-override\_*** | +| ExpressRoute port | *```resourceName```*-DirectERTxLightLevelHighAlert | Metrics | ***\_amba-TxLightLevel-High-threshold-override\_*** | +| ExpressRoute port | *```resourceName```*-DirectERTxLightLevelLowAlert | Metrics | ***\_amba-TxLightLevel-Low-threshold-override\_*** | +| Front Door | *```resourceName```*-BackendHealthPercentage | Metrics | ***\_amba-BackendHealthPercentage-threshold-override\_*** | +| Front Door | *```resourceName```*-BackendRequestLatencyAlert | Metrics | ***Not available since it uses dynamic thresholds*** | +| Load balancer | *```resourceName```*-ALBDataPathAvailability | Metrics | ***\_amba-VipAvailability-threshold-override\_*** | +| Load balancer | *```resourceName```*-ALBGlobalBackendAvailability | Metrics | ***\_amba-GlobalBackendAvailability-threshold-override\_*** | +| Load balancer | *```resourceName```*-ALBHealthProbeStatus | Metrics | ***\_amba-DipAvailability-threshold-override\_*** | +| Load balancer | *```resourceName```*-ALBUsedSNATPorts | Metrics | ***\_amba-UsedSNATPorts-threshold-override\_*** | +| Network security group | ActivityNSGDelete | Activity Log | ***Not available since Activity Log based alerts do not have thresholds*** | +| Private DNS zone | *```resourceName```*-CapacityUtilizationAlert | Metrics | ***\_amba-VirtualNetworkLinkCapacityUtilization-threshold-override\_*** | +| Private DNS zone | *```resourceName```*-QueryVolumeAlert | Metrics | ***\_amba-QueryVolume-threshold-override\_*** | +| Private DNS zone | *```resourceName```*-RecordSet_Capacity_Utilization | Metrics | ***\_amba-RecordSetCapacityUtilization-threshold-override\_*** | +| Private DNS zone | *```resourceName```*-RequestsAlert | Metrics | ***\_amba-VirtualNetworkWithRegistrationCapacityUtilization-threshold-override\_*** | +| Public IP address | *```resourceName```*-BytesInDDOSAlert | Metrics | ***\_amba-bytesinddos-threshold-override\_*** | +| Public IP address | *```resourceName```*-DDOS_Attack | Metrics | ***\_amba-ifunderddosattack-threshold-override\_*** | +| Public IP address | *```resourceName```*-PacketsInDDosAlert | Metrics | ***\_amba-PacketsInDDoS-threshold-override\_*** | +| Public IP address | *```resourceName```*-VIPAvailabityAlert | Metrics | ***\_amba-VipAvailability-threshold-override\_*** | +| Route table | ActivityUDRUpdate | Activity Log | ***Not available since Activity Log based alerts do not have thresholds*** | +| Traffic Manager profile | *```resourceName```*-EndpointHealthAlert | Metrics | ***\_amba-EndpointHealth-threshold-override\_*** | +| Virtual network gateway | *```resourceName```*-TunnelBandwidthAlert | Metrics | ***\_amba-TunnelAverageBandwidth-threshold-override\_*** | +| Virtual network gateway | *```resourceName```*-TunnelEgressAlert | Metrics | ***\_amba-TunnelEgressBytes-threshold-override\_*** | +| Virtual network gateway | *```resourceName```*-TunnelEgressPacketDropCountAlert | Metrics | ***Not available since it uses dynamic thresholds*** | +| Virtual network gateway | *```resourceName```*-TunnelEgressPacketDropTSMismatchAlert | Metrics | ***Not available since it uses dynamic thresholds*** | +| Virtual network gateway | *```resourceName```*-GatewayERBitsAlert | Metrics | ***\_amba-ExpressRouteGatewayBitsPerSecond-threshold-override\_*** | +| Virtual network gateway | *```resourceName```*-GatewayERCPUAlert | Metrics | ***\_amba-ExpressRouteGatewayCpuUtilization-threshold-override\_*** | +| Virtual network gateway | *```resourceName```*-TunnelIngressAlert | Metrics | ***\_amba-TunnelIngressBytes-threshold-override\_*** | +| Virtual network gateway | *```resourceName```*-TunnelIngressPacketDropCountAlert | Metrics | ***Not available since it uses dynamic thresholds*** | +| Virtual network gateway | *```resourceName```*-TunnelIngressPacketDropTSMismatchAlert | Metrics | ***Not available since it uses dynamic thresholds*** | +| Virtual network | *```resourceName```*-DDOSAttackAlert | Metrics | ***\_amba-ifunderddosattack-threshold-override\_*** | +| VPN Gateway | ActivityVPNGatewayDelete | Activity Log | ***Not available since Activity Log based alerts do not have thresholds*** | +| VPN Gateway | *```resourceName```*-GatewayBandwidthAlert | Metrics | ***\_amba-tunnelaveragebandwidth-threshold-override\_*** | +| VPN Gateway | *```resourceName```*-BGPPeerStatusAlert | Metrics | ***\_amba-bgppeerstatus-threshold-override\_*** | +| VPN Gateway | *```resourceName```*-TunnelEgressAlert | Metrics | ***\_amba-tunnelegressbytes-threshold-override\_*** | +| VPN Gateway | *```resourceName```*-TunnelEgressPacketDropCountAlert | Metrics | ***Not available since it uses dynamic thresholds*** | +| VPN Gateway | *```resourceName```*-TunnelEgressPacketDropTSMismatchAlert | Metrics | ***Not available since it uses dynamic thresholds*** | +| VPN Gateway | *```resourceName```*-TunnelIngressAlert | Metrics | ***\_amba-tunnelingressbytes-threshold-override\_*** | +| VPN Gateway | *```resourceName```*-TunnelIngressPacketDropCount | Metrics | ***Not available since it uses dynamic thresholds*** | +| VPN Gateway | *```resourceName```*-TunnelIngressPacketDropTSMismatchAlert | Metrics | ***Not available since it uses dynamic thresholds*** | +| Log Analytics workspace | ActivityLAWorkspaceDelete | Activity Log | ***Not available since Activity Log based alerts do not have thresholds*** | +| Log Analytics workspace | ActivityLAWorkspaceRegenKey | Activity Log | ***Not available since Activity Log based alerts do not have thresholds*** | +| Subscription | ResourceHealthUnhealthyAlert | Resource health | ***Not available since Activity Log based alerts do not have thresholds*** | +| Subscription | ServiceHealthHealth | Service health | ***Not available since Activity Log based alerts do not have thresholds*** | +| Subscription | ServiceHealthIncident | Service health | ***Not available since Activity Log based alerts do not have thresholds*** | +| Subscription | ServiceHealthMaintenance | Service health | ***Not available since Activity Log based alerts do not have thresholds*** | +| Subscription | ServiceSecurityIncident | Service health | ***Not available since Activity Log based alerts do not have thresholds*** | +| Storage account | ActivitySADelete | Activity Log | ***Not available since Activity Log based alerts do not have thresholds*** | +| Storage account | *```resourceName```*-AvailabilityAlert | Metrics | ***\_amba-Availability-threshold-override\_*** | +| App Service plan | *```resourceName```*-CpuPercentage | Metrics | ***\_amba-CpuPercentage-threshold-override\_*** | +| App Service plan | *```resourceName```*-DiskQueueLengthAlert | Metrics | ***Not available since it uses dynamic thresholds*** | +| App Service plan | *```resourceName```*-HttpQueueLengthAlert | Metrics | ***Not available since it uses dynamic thresholds*** | +| App Service plan | *```resourceName```*-MemoryPercentage | Metrics | ***\_amba-MemoryPercentage-threshold-override\_*** | diff --git a/docs/content/patterns/alz/Available_features/Threshold-Override.md b/docs/content/patterns/alz/Available_features/Threshold-Override.md new file mode 100644 index 000000000..6cf316a32 --- /dev/null +++ b/docs/content/patterns/alz/Available_features/Threshold-Override.md @@ -0,0 +1,54 @@ +--- +title: Alert Threshold Override +geekdocCollapseSection: true +weight: 85 +--- + +# Overview + +The ***Alert Threshold Override*** feature, available with release [2024-09-05](../../Whats-New#2024-09-05), allows both Greenfield and Brownfield customers to override alert threshold for specific resources during or after the deployment of AMBA-ALZ. Thanks to this new feature, it's now possible to use a tag with specific name and value, to override the default alert threshold for specific resources. The new value will be used, only for the tagged resources, in place of the global one coming from the parameter file. + +# How this feature works + +This feature is only available for metrics and log-search alerts, since Activity Log based alerts do not use threshold and, as such, cannot benefits from this new enhancement. Using the feature is easy: customers need to create a resource tag with a specific name and assign a value of their choice. Once this release is deployed, tags can be created either before or after the execution of remediation task. However, the feature behavior differs between Metric and Log-search alerts. + +## Metrics alerts + +For metric alerts, if tags are configured before the remediation tasks execution, corresponding alerts (which are resource-specific) will be created using different thresholds for the same resource type: + +![Metric Alerts - Override threshold at work](../../media/MetricAlerts-OverrideThresholdAtWork.png) + +If the tags are configured after the remediation task have completed, given the tag being part of the compliance criteria, the resource will be marked as not compliant, as such customers will just need to remediate the corresponding policy initiative(s) as documented at [Remediate Policies](../../deploy/Remediate-Policies) to reconfigure exiting alerts with the new threshold. + +## Log-search alerts +Considering the different nature of log-search alerts where resource information is retrieved at query runtime, it does not make any difference if the tags are configured before or after the remediation task execution. The log-search alert query is created with a placeholder containing the threshold passed by the parameter file and with a logic to look at the resource-specific override tag, thanks to the ability to [Correlate data in Azure Data Explorer and Azure Resource Graph with data in a Log Analytics workspace](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/azure-monitor-data-explorer-proxy). If the specific override tag name is present, the query will use the tag value as new threshold, otherwise it will use the default one passed through the parameter file: + +![Log-search Alerts - Override threshold at work](../../media/LogsearchAlerts-OverrideThresholdAtWork.png) + +## Which tag does customers need to create + +To work correctly, this feature needs to look at specific tag names. Unfortunately it is not possible to allow for more flexibility in tag name in this case. Tag names have been defined, according to the following naming convention: + +{{< hint type=Info >}} +Mapping between resource type friendly name and resource provider namespace (together with the recommended abbreviation) can be found at [Abbreviation recommendations for Azure resources](https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/resource-abbreviations) +{{< /hint >}} + +```***_amba--threshold-override_***``` + +There might be cases where for the same resource, the same metric is used more than one. In this scenario, we implemented a differentiator value inserted right after the metric name, making the naming convention resampling the following format: + +```***_amba---threshold-override_***``` + +The following table contains the mapping between the alert name and the corresponding tag value to be created: + +
+ +### Log-search alerts table + +{{% include "Log_Search_Alert_Table.md" %}} + +
+ +### Metric alerts table + +{{% include "Metrics_Alert_Table.md" %}} diff --git a/docs/content/patterns/alz/Available_features/_index.md b/docs/content/patterns/alz/Available_features/_index.md new file mode 100644 index 000000000..ff2b08208 --- /dev/null +++ b/docs/content/patterns/alz/Available_features/_index.md @@ -0,0 +1,5 @@ +--- +title: Available features +geekdocCollapseSection: true +weight: 50 +--- diff --git a/docs/content/patterns/alz/Disabling-Policies.md b/docs/content/patterns/alz/Disabling-Policies.md index 0f8730cdb..2dad3fd17 100644 --- a/docs/content/patterns/alz/Disabling-Policies.md +++ b/docs/content/patterns/alz/Disabling-Policies.md @@ -92,11 +92,15 @@ The PolicyEffect parameter is used for the configuration of the effect of the Po ## MonitorDisable parameter -It´s also possible to exclude certain resources from being monitored. You may not want to monitor pre-production or dev environments. The MonitorDisable parameter contains the Tag name to determine whether a resource should be included. By default, creating the tag MonitorDisable with value "true" will prevent deployment of alert rules on those resources. This is easily adjusted to use existing tags, for example you could configure the parameter with the tag name "Environment" and tell it to deploy only if the tag value equals "prod", or when the tag isnt equal to "dev". Currently only the tag name is a parameter, other changes require minor changes in the code. +It´s also possible to exclude certain resources from being monitored. You may not want to monitor pre-production or dev environments. The MonitorDisable parameter contains the tag name and tag value to determine whether a resource should be included. By default, creating the tag MonitorDisable with value "true" will prevent deployment of alert rules on those resources. This can be easily adjusted to use existing tags and tag values. For example you could configure the parameters with the tag name ***Environment*** and tag value of ***Production*** or ***Test*** or ***Sandbox*** or all of them to exclude resources in these environments (see the sample parameter screenshot). + +![MonitorDisable* parameters](../media/MonitorDisableParams.png) + +This will deploy policy definitions which will only be evaluated and remediated if the tag value(s) are not included in the list you provided. ### How it works -The policyRule only continues if "allOff" is true. Meaning, the deployment will continue as long as the MonitorDisable tag doesn't exist or doesn't hold the value "true". When the tag holds "true", the "allOff" will return "false" as "notEquals": "true" is no longer satisfied, causing the deployment to stop +The policyRule only continues if "allOff" is true. Meaning, the deployment will continue as long as the MonitorDisableTagName tag doesn't exist or doesn't hold the any of the values listed in the MonitorDisableTagValues parameter. When the tag holds one of the configured values, the "allOff" will return "false" as *"notIn": "[[parameters('MonitorDisableTagValues')]"* is no longer satisfied, causing the evaluation and hence the remediation to stop. ```json "policyRule": { @@ -107,9 +111,14 @@ The policyRule only continues if "allOff" is true. Meaning, the deployment will "equals": "Microsoft.Automation/automationAccounts" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] - } + }, ``` + +Given the different resource scope that this method can be applied to, we made it working a little bit different when it comes to log-based alerts. For instance, the virtual machine alerts are scoped to subscription and tagging the subcription would result in disabling all the policies targeted at it. +For this reason, and thanks to the new **Bring Your Own User Assigned Managed Identity (BYO UAMI)*** included in the [2024-06-05](../../Whats-New#2024-06-05) release and to the ability to query Azure resource Graph using Azure Monitor (see [Quickstart: Create alerts with Azure Resource Graph and Log Analytics](https://learn.microsoft.com/en-us/azure/governance/resource-graph/alerts-query-quickstart?tabs=azure-resource-graph)), it is now possible to disable individual alerts for both Azure and hybrid virtual machines after they are created. We got requests to stop alerting fro virtual machines that were off for maintenance and this enhancement came up just in time. + +Should you need to disable the alerts for your virtual machines after they are created, just make sure you tag the relevant resources accordingly. The alert queries have been modified to look at resource properties in [Azure Resource Graph](https://learn.microsoft.com/en-us/azure/governance/resource-graph/overview). If the resource contains the given tag name and tag value, it is made part of an exclusion list, so alerts will not be generated for them. This behavior allows you to dinamically and rapidly exclude the necessary resources from being alerted without the need of deleteing the alert, tag the resource and run the remediation again. diff --git a/docs/content/patterns/alz/Policy-Initiatives.md b/docs/content/patterns/alz/Policy-Initiatives.md index 574e71426..8bbbac3eb 100644 --- a/docs/content/patterns/alz/Policy-Initiatives.md +++ b/docs/content/patterns/alz/Policy-Initiatives.md @@ -91,37 +91,29 @@ This initiative is intended for assignment of policies relevant to identity comp | Deploy KeyVault Capacity Alert | ALZ_KVCapacity | [deploy-kv_capacity_alert.json](../../../services/KeyVault/vaults/Deploy-KV-Capacity-Alert.json) | disabled | | Deploy Activity Log Key Vault Delete Alert | ALZ_activityKVDelete | [deploy-activitylog-KeyVault-Del.json](../../../services/KeyVault/vaults/Deploy-ActivityLog-KeyVault-Del.json) | deployIfNotExists | -## Landing Zone initiative +## Key Management initiative -This initiative is intended for assignment of policies relevant to a landing zone in the ALZ structure. With the guidance provided in [Introduction to deploying the ALZ Pattern](../deploy/Introduction-to-deploying-the-ALZ-Pattern) this will be assigned to the Landing Zones management group in the ALZ reference architecture. For details on which policies are included in the initiative as well as what the default enablement state of the policy is, refer to the below table. +This initiative deploys Azure Monitor Baseline Alerts to monitor Key Management Services such as Azure Key Vault, and Managed HSM. With the guidance provided in [Introduction to deploying the ALZ Pattern](../deploy/Introduction-to-deploying-the-ALZ-Pattern) this will be assigned to the Landing Zones management group in the ALZ reference architecture. For details on which policies are included in the initiative as well as what the default enablement state of the policy is, refer to the below table. | **Policy Name** | **Policy Reference ID** | **Path to policy .json file** | **Policy default effect** | | ----------------------------------------------------------- | ---------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------- | -| Deploy SA Availability Alert | ALZ_StorageAccountAvailability | [deploy-sa_availability_alert.json](../../../services/Storage/storageAccounts/Deploy-SA-Availability-Alert.json) | deployIfNotExists | | Deploy KeyVault Requests Alert | ALZ_KVRequest | [deploy-kv_requests_alert.json](../../../services/KeyVault/vaults/Deploy-KV-Requests-Alert.json) | disabled | | Deploy KeyVault Availability Alert | ALZ_KvAvailability | [deploy-kv_availability_alert.json](../../../services/KeyVault/vaults/Deploy-KV-Availability-Alert.json) | deployIfNotExists- | | Deploy KeyVault Latency Alert | ALZ_KvLatencyAvailability | [deploy-kv_latency_alert.json](../../../services/KeyVault/vaults/Deploy-KV-Latency-Alert.json) | deployIfNotExists | | Deploy KeyVault Capacity Alert | ALZ_KVCapacity | [deploy-kv_capacity_alert.json](../../../services/KeyVault/vaults/Deploy-KV-Capacity-Alert.json) | deployIfNotExists | | Deploy Activity Log Key Vault Delete Alert | ALZ_activityKVDelete | [deploy-activitylog-KeyVault-Del.json](../../../services/KeyVault/vaults/Deploy-ActivityLog-KeyVault-Del.json) | deployIfNotExists | -| Deploy Activity Log Route Table Update Alert | ALZ_activityUDRUpdate | [deploy-activitylog-RouteTable-Update.json](../../../services/Network/routeTables/Deploy-ActivityLog-RouteTable-Update.json) | deployIfNotExists | -| Deploy Activity Log NSG Delete Alert | ALZ_activityNSGDelete | [deploy-activitylog-NSG-Del.json](../../../services/Network/networkSecurityGroups/Deploy-ActivityLog-NSG-Del.json) | deployIfNotExists | + +## Load Balancing initiative + +This initiative deploys Azure Monitor Baseline Alerts to monitor Load Balancing Services such as Load Balancer, Application Gateway, Traffic Manager, and Azure Front Door. With the guidance provided in [Introduction to deploying the ALZ Pattern](../deploy/Introduction-to-deploying-the-ALZ-Pattern) this will be assigned to the Landing Zones management group in the ALZ reference architecture. For details on which policies are included in the initiative as well as what the default enablement state of the policy is, refer to the below table. + +| **Policy Name** | **Policy Reference ID** | **Path to policy .json file** | **Policy default effect** | +| ----------------------------------------------------------- | ---------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------- | | Deploy PIP Bytes in DDoS Attack Alert | ALZ_PIPBytesInDDoS | [deploy-pip_bytesinddosattack_alert.json](../../../services/Network/publicIPAddresses/Deploy-PIP-BytesInDDOSAttack-Alert.json) | disabled | | Deploy PIP DDoS Attack Alert | ALZ_PIPDDoSAttack | [deploy-pip_ddosattack_alert.json](../../../services/Network/publicIPAddresses/Deploy-PIP-DDOSAttack-Alert.json) | deployIfNotExists | | Deploy PIP Packets in DDoS Attack Alert | ALZ_PIPPacketsInDDoS | [deploy-pip_packetsinddos_alert.json](../../../services/Network/publicIPAddresses/Deploy-PIP-PacketsInDDOS-Alert.json) | disabled | | Deploy PIP VIP Availability Alert | ALZ_PIPVIPAvailability | [deploy-pip_vipavailability_alert.json](../../../services/Network/publicIPAddresses/Deploy-PIP-VIPAvailability-Alert.json) | deployIfNotExists | | Deploy VNet DDoS Attack Alert | ALZ_VNETDDOSAttack | [deploy-vnet_ddosattack_alert.json](../../../services/Network/virtualNetworks/Deploy-VNET-DDOSAttack-Alert.json) | deployIfNotExists | -| Deploy RV Backup Health Monitoring Alerts | ALZ_RVBackupHealthMonitor | [deploy-rv_backuphealth_monitor.json](../../../services/RecoveryServices/vaults/Modify-RSV-BackupHealth-Alert.json) | modify | -| Deploy VM HeartBeat Alert | ALZ_VMHeartBeatRG | [deploy-vm-HeartBeat_alert.json](../../../services/Compute/virtualMachines/Deploy-VM-HeartBeat-Alert.json) | deployIfNotExists | -| Deploy VM Network Read Alert | ALZ_VMNetworkIn | [deploy-vm-NetworkIn_alert.json](../../../services/Compute/virtualMachines/Deploy-VM-NetworkIn-Alert.json) | deployIfNotExists | -| Deploy VM Network Write Alert | ALZ_VMNetworkOut | [deploy-vm-NetworkOut_alert.json](../../../services/Compute/virtualMachines/Deploy-VM-NetworkOut-Alert.json) | deployIfNotExists | -| Deploy VM OS Disk Read Latency Alert | ALZ_VMOSDiskReadLatency | [deploy-vm-OSDiskreadLatency_alert.json](../../../services/Compute/virtualMachines/Deploy-VM-OSDiskReadLatency-Alert.json) | deployIfNotExists | -| Deploy VM OS Disk Write Latency Alert | ALZ_VMOSDiskWriteLatency | [deploy-vm-OSDiskwriteLatency_alert.json](../../../services/Compute/virtualMachines/Deploy-VM-OSDiskWriteLatency-Alert.json) | deployIfNotExists | -| Deploy VM OS Disk Space Alert | ALZ_VMOSDiskSpace | [deploy-vm-OSDiskSpace_alert.json](../../../services/Compute/virtualMachines/Deploy-VM-OSDiskSpace-Alert.json) | deployIfNotExists | -| Deploy VM CPU Alert | ALZ_VMPercentCPU | [deploy-vm-PercentCPU_alert.json](../../../services/Compute/virtualMachines/Deploy-VM-PercentCPU-Alert.json) | deployIfNotExists | -| Deploy VM Memory Alert | ALZ_VMPercentMemory | [deploy-vm-PercentMemory_alert.json](../../../services/Compute/virtualMachines/Deploy-VM-PercentMemory-Alert.json) | deployIfNotExists | -| Deploy VM Data Disk Space Alert | ALZ_VMDataDiskSpace | [deploy-vm-dataDiskSpace_alert.json](../../../services/Compute/virtualMachines/Deploy-VM-DataDiskSpace-Alert.json) | deployIfNotExists | -| Deploy VM Data Disk Read Latency Alert | ALZ_VMDataDiskReadLatency | [deploy-vm-dataDiskreadLatency_alert.json](../../../services/Compute/virtualMachines/Deploy-VM-DataDiskReadLatency-Alert.json) | deployIfNotExists | -| Deploy VM Data Disk Write Latency Alert | ALZ_VMDataDiskWriteLatency | [deploy-vm-dataDiskwriteLatency_alert.json](../../../services/Compute/virtualMachines/Deploy-VM-DataDiskWriteLatency-Alert.json) | deployIfNotExists | | Deploy AGW ApplicationGatewayTotalTime Alert | ALZ_AGWTotalTime | [Deploy-AGW-ApplicationGatewayTotalTime-Alert.json](../../../services/Network/applicationGateways/Deploy-AGW-ApplicationGatewayTotalTime-Alert.json) | deployIfNotExists | | Deploy AGW BackendLastByteResponseTime Alert | ALZ_AGWBackendLastByteResponseTime | [Deploy-AGW-BackendLastByteResponseTime-Alert.json](../../../services/Network/applicationGateways/Deploy-AGW-BackendLastByteResponseTime-Alert.json) | deployIfNotExists | | Deploy AGW Capacity Units Alert | ALZ_AGWCapacityUnits | [Deploy-AGW-CapacityUnits-Alert.json](../../../services/Network/applicationGateways/Deploy-AGW-CapacityUnits-Alert.json) | deployIfNotExists | @@ -139,12 +131,62 @@ This initiative is intended for assignment of policies relevant to a landing zon | Deploy FrontDoor CDN Profile Percentage4XX Alert | ALZ_CDNPPercentage4XX | [Deploy-CDNP-Percentage4XX-Alert.json](../../../services/Cdn/profiles/Deploy-CDNP-Percentage4XX-Alert.json) | deployIfNotExists | | Deploy FrontDoor CDN Profile Percentage5XX Alert | ALZ_CDNPPercentage5XX | [Deploy-CDNP-Percentage5XX-Alert.json](../../../services/Cdn/profiles/Deploy-CDNP-Percentage5XX-Alert.json) | deployIfNotExists | | Deploy Traffic Manager Endpoint Health Alert | ALZ_TMEndpointHealth | [Deploy-TM-EndpointHealth-Alert.json](../../../services/Network/trafficmanagerprofiles/Deploy-TM-EndpointHealth-Alert.json) | deployIfNotExists | +| Deploy Frontdoor Backend Health Percentage Alert | ALZ_FDBackendHealth | [Deploy-FD-BackendHealth-Alert.json](../../../services/Network/frontDoors/Deploy-FD-BackendHealth-Alert.json) | deployIfNotExists | +| Deploy Frontdoor Backend Request Latency Alert | ALZ_FDBackendRequestLatency | [Deploy-FD-BackendRequestLatency-Alert.json](../../../services/Network/frontDoors/Deploy-FD-BackendRequestLatency-Alert.json) | deployIfNotExists | + +## Network Changes initiative + +This initiative implements Azure Monitor Baseline Alerts to monitor alterations in Network Routing and Security, such as modifications to Route Tables and the removal of Network Security Groups. With the guidance provided in [Introduction to deploying the ALZ Pattern](../deploy/Introduction-to-deploying-the-ALZ-Pattern) this will be assigned to the Landing Zones management group in the ALZ reference architecture. For details on which policies are included in the initiative as well as what the default enablement state of the policy is, refer to the below table. + +| **Policy Name** | **Policy Reference ID** | **Path to policy .json file** | **Policy default effect** | +| ----------------------------------------------------------- | ---------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------- | +| Deploy Activity Log Route Table Update Alert | ALZ_activityUDRUpdate | [deploy-activitylog-RouteTable-Update.json](../../../services/Network/routeTables/Deploy-ActivityLog-RouteTable-Update.json) | deployIfNotExists | +| Deploy Activity Log NSG Delete Alert | ALZ_activityNSGDelete | [deploy-activitylog-NSG-Del.json](../../../services/Network/networkSecurityGroups/Deploy-ActivityLog-NSG-Del.json) | deployIfNotExists | + +## Recovery Services initiative + +This initiative deploys Azure Monitor Baseline Alerts to monitor Recovery Services such as Azure Backup, and Azure Site Recovery. With the guidance provided in [Introduction to deploying the ALZ Pattern](../deploy/Introduction-to-deploying-the-ALZ-Pattern) this will be assigned to the Landing Zones management group in the ALZ reference architecture. For details on which policies are included in the initiative as well as what the default enablement state of the policy is, refer to the below table. + +| **Policy Name** | **Policy Reference ID** | **Path to policy .json file** | **Policy default effect** | +| ----------------------------------------------------------- | ---------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------- | +| Deploy RV Backup Health Monitoring Alerts | ALZ_RVBackupHealthMonitor | [deploy-rv_backuphealth_monitor.json](../../../services/RecoveryServices/vaults/Modify-RSV-BackupHealth-Alert.json) | modify | + +## Storage initiative + +This initiative deploys Azure Monitor Baseline Alerts to monitor Storage Services such as Storage accounts. With the guidance provided in [Introduction to deploying the ALZ Pattern](../deploy/Introduction-to-deploying-the-ALZ-Pattern) this will be assigned to the Landing Zones management group in the ALZ reference architecture. For details on which policies are included in the initiative as well as what the default enablement state of the policy is, refer to the below table. + +| **Policy Name** | **Policy Reference ID** | **Path to policy .json file** | **Policy default effect** | +| ----------------------------------------------------------- | ---------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------- | +| Deploy SA Availability Alert | ALZ_StorageAccountAvailability | [deploy-sa_availability_alert.json](../../../services/Storage/storageAccounts/Deploy-SA-Availability-Alert.json) | deployIfNotExists | + +## VM initiative + +This initiative deploys Azure Monitor Baseline Alerts to monitor Azure Virtual Machines. With the guidance provided in [Introduction to deploying the ALZ Pattern](../deploy/Introduction-to-deploying-the-ALZ-Pattern) this will be assigned to the Landing Zones management group in the ALZ reference architecture. For details on which policies are included in the initiative as well as what the default enablement state of the policy is, refer to the below table. + +| **Policy Name** | **Policy Reference ID** | **Path to policy .json file** | **Policy default effect** | +| ----------------------------------------------------------- | ---------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------- | +| Deploy VM HeartBeat Alert | ALZ_VMHeartBeatRG | [deploy-vm-HeartBeat_alert.json](../../../services/Compute/virtualMachines/Deploy-VM-HeartBeat-Alert.json) | deployIfNotExists | +| Deploy VM Network Read Alert | ALZ_VMNetworkIn | [deploy-vm-NetworkIn_alert.json](../../../services/Compute/virtualMachines/Deploy-VM-NetworkIn-Alert.json) | deployIfNotExists | +| Deploy VM Network Write Alert | ALZ_VMNetworkOut | [deploy-vm-NetworkOut_alert.json](../../../services/Compute/virtualMachines/Deploy-VM-NetworkOut-Alert.json) | deployIfNotExists | +| Deploy VM OS Disk Read Latency Alert | ALZ_VMOSDiskReadLatency | [deploy-vm-OSDiskreadLatency_alert.json](../../../services/Compute/virtualMachines/Deploy-VM-OSDiskReadLatency-Alert.json) | deployIfNotExists | +| Deploy VM OS Disk Write Latency Alert | ALZ_VMOSDiskWriteLatency | [deploy-vm-OSDiskwriteLatency_alert.json](../../../services/Compute/virtualMachines/Deploy-VM-OSDiskWriteLatency-Alert.json) | deployIfNotExists | +| Deploy VM OS Disk Space Alert | ALZ_VMOSDiskSpace | [deploy-vm-OSDiskSpace_alert.json](../../../services/Compute/virtualMachines/Deploy-VM-OSDiskSpace-Alert.json) | deployIfNotExists | +| Deploy VM CPU Alert | ALZ_VMPercentCPU | [deploy-vm-PercentCPU_alert.json](../../../services/Compute/virtualMachines/Deploy-VM-PercentCPU-Alert.json) | deployIfNotExists | +| Deploy VM Memory Alert | ALZ_VMPercentMemory | [deploy-vm-PercentMemory_alert.json](../../../services/Compute/virtualMachines/Deploy-VM-PercentMemory-Alert.json) | deployIfNotExists | +| Deploy VM Data Disk Space Alert | ALZ_VMDataDiskSpace | [deploy-vm-dataDiskSpace_alert.json](../../../services/Compute/virtualMachines/Deploy-VM-DataDiskSpace-Alert.json) | deployIfNotExists | +| Deploy VM Data Disk Read Latency Alert | ALZ_VMDataDiskReadLatency | [deploy-vm-dataDiskreadLatency_alert.json](../../../services/Compute/virtualMachines/Deploy-VM-DataDiskReadLatency-Alert.json) | deployIfNotExists | +| Deploy VM Data Disk Write Latency Alert | ALZ_VMDataDiskWriteLatency | [deploy-vm-dataDiskwriteLatency_alert.json](../../../services/Compute/virtualMachines/Deploy-VM-DataDiskWriteLatency-Alert.json) | deployIfNotExists | + +## Web initiative + +This initiative deploys Azure Monitor Baseline Alerts to monitor Web Services such as App Services. This initiative is intended for assignment of policies relevant to a landing zone in the ALZ structure. With the guidance provided in [Introduction to deploying the ALZ Pattern](../deploy/Introduction-to-deploying-the-ALZ-Pattern) this will be assigned to the Landing Zones management group in the ALZ reference architecture. For details on which policies are included in the initiative as well as what the default enablement state of the policy is, refer to the below table. + +| **Policy Name** | **Policy Reference ID** | **Path to policy .json file** | **Policy default effect** | +| ----------------------------------------------------------- | ---------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------- | | Deploy App Service Plan CPU Percentage Alert | ALZ_WSFCPUPercentage | [Deploy-WSF-CPUPercentage-Alert.json](../../../services/Web/serverFarms/Deploy-WSF-CPUPercentage-Alert.json) | deployIfNotExists | | Deploy App Service Plan Memory Percentage Alert | ALZ_WSFMemoryPercentage | [Deploy-WSF-MemoryPercentage-Alert.json](../../../services/Web/serverFarms/Deploy-WSF-MemoryPercentage-Alert.json) | deployIfNotExists | | Deploy App Service Plan Disk Queue Length Alert | ALZ_WSFDiskQueueLength | [Deploy-WSF-DiskQueueLength-Alert.json](../../../services/Web/serverFarms/Deploy-WSF-DiskQueueLength-Alert.json) | deployIfNotExists | | Deploy App Service Plan Http Queue Length Alert | ALZ_WSFHttpQueueLength | [Deploy-WSF-HttpQueueLength-Alert.json](../../../services/Web/serverFarms/Deploy-WSF-HttpQueueLength-Alert.json) | deployIfNotExists | -| Deploy Frontdoor Backend Health Percentage Alert | ALZ_FDBackendHealth | [Deploy-FD-BackendHealth-Alert.json](../../../services/Network/frontDoors/Deploy-FD-BackendHealth-Alert.json) | deployIfNotExists | -| Deploy Frontdoor Backend Request Latency Alert | ALZ_FDBackendRequestLatency | [Deploy-FD-BackendRequestLatency-Alert.json](../../../services/Network/frontDoors/Deploy-FD-BackendRequestLatency-Alert.json) | deployIfNotExists | ## Hybrid VM initiative @@ -186,3 +228,58 @@ This initiative is intended for assignment of policies relevant to notification | ------------------------------------------ | ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------- | ------------------------- | | Deploy AMBA Notification Assets | ALZ_AlertProcessing_Rule | [deploy-AlertProcessingRule-deploy.json](../../../services/AlertsManagement/actionRules/Deploy-AlertProcessingRule-Deploy.json) | deployIfNotExists | | Deploy AMBA Notification Suppression Asset | ALZ_Suppression_AlertProcessing_Rule | [deploy-AlertProcessingRule-Suppression.json](../../../services/AlertsManagement/actionRules/Deploy-AlertProcessingRule-Suppression.json) | deployIfNotExists | + +## Landing Zone initiative (Deprecated) + +This initiative is intended for assignment of policies relevant to a landing zone in the ALZ structure. With the guidance provided in [Introduction to deploying the ALZ Pattern](../deploy/Introduction-to-deploying-the-ALZ-Pattern) this will be assigned to the Landing Zones management group in the ALZ reference architecture. For details on which policies are included in the initiative as well as what the default enablement state of the policy is, refer to the below table. + +| **Policy Name** | **Policy Reference ID** | **Path to policy .json file** | **Policy default effect** | +| ----------------------------------------------------------- | ---------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------- | +| Deploy SA Availability Alert | ALZ_StorageAccountAvailability | [deploy-sa_availability_alert.json](../../../services/Storage/storageAccounts/Deploy-SA-Availability-Alert.json) | deployIfNotExists | +| Deploy KeyVault Requests Alert | ALZ_KVRequest | [deploy-kv_requests_alert.json](../../../services/KeyVault/vaults/Deploy-KV-Requests-Alert.json) | disabled | +| Deploy KeyVault Availability Alert | ALZ_KvAvailability | [deploy-kv_availability_alert.json](../../../services/KeyVault/vaults/Deploy-KV-Availability-Alert.json) | deployIfNotExists- | +| Deploy KeyVault Latency Alert | ALZ_KvLatencyAvailability | [deploy-kv_latency_alert.json](../../../services/KeyVault/vaults/Deploy-KV-Latency-Alert.json) | deployIfNotExists | +| Deploy KeyVault Capacity Alert | ALZ_KVCapacity | [deploy-kv_capacity_alert.json](../../../services/KeyVault/vaults/Deploy-KV-Capacity-Alert.json) | deployIfNotExists | +| Deploy Activity Log Key Vault Delete Alert | ALZ_activityKVDelete | [deploy-activitylog-KeyVault-Del.json](../../../services/KeyVault/vaults/Deploy-ActivityLog-KeyVault-Del.json) | deployIfNotExists | +| Deploy Activity Log Route Table Update Alert | ALZ_activityUDRUpdate | [deploy-activitylog-RouteTable-Update.json](../../../services/Network/routeTables/Deploy-ActivityLog-RouteTable-Update.json) | deployIfNotExists | +| Deploy Activity Log NSG Delete Alert | ALZ_activityNSGDelete | [deploy-activitylog-NSG-Del.json](../../../services/Network/networkSecurityGroups/Deploy-ActivityLog-NSG-Del.json) | deployIfNotExists | +| Deploy PIP Bytes in DDoS Attack Alert | ALZ_PIPBytesInDDoS | [deploy-pip_bytesinddosattack_alert.json](../../../services/Network/publicIPAddresses/Deploy-PIP-BytesInDDOSAttack-Alert.json) | disabled | +| Deploy PIP DDoS Attack Alert | ALZ_PIPDDoSAttack | [deploy-pip_ddosattack_alert.json](../../../services/Network/publicIPAddresses/Deploy-PIP-DDOSAttack-Alert.json) | deployIfNotExists | +| Deploy PIP Packets in DDoS Attack Alert | ALZ_PIPPacketsInDDoS | [deploy-pip_packetsinddos_alert.json](../../../services/Network/publicIPAddresses/Deploy-PIP-PacketsInDDOS-Alert.json) | disabled | +| Deploy PIP VIP Availability Alert | ALZ_PIPVIPAvailability | [deploy-pip_vipavailability_alert.json](../../../services/Network/publicIPAddresses/Deploy-PIP-VIPAvailability-Alert.json) | deployIfNotExists | +| Deploy VNet DDoS Attack Alert | ALZ_VNETDDOSAttack | [deploy-vnet_ddosattack_alert.json](../../../services/Network/virtualNetworks/Deploy-VNET-DDOSAttack-Alert.json) | deployIfNotExists | +| Deploy RV Backup Health Monitoring Alerts | ALZ_RVBackupHealthMonitor | [deploy-rv_backuphealth_monitor.json](../../../services/RecoveryServices/vaults/Modify-RSV-BackupHealth-Alert.json) | modify | +| Deploy VM HeartBeat Alert | ALZ_VMHeartBeatRG | [deploy-vm-HeartBeat_alert.json](../../../services/Compute/virtualMachines/Deploy-VM-HeartBeat-Alert.json) | deployIfNotExists | +| Deploy VM Network Read Alert | ALZ_VMNetworkIn | [deploy-vm-NetworkIn_alert.json](../../../services/Compute/virtualMachines/Deploy-VM-NetworkIn-Alert.json) | deployIfNotExists | +| Deploy VM Network Write Alert | ALZ_VMNetworkOut | [deploy-vm-NetworkOut_alert.json](../../../services/Compute/virtualMachines/Deploy-VM-NetworkOut-Alert.json) | deployIfNotExists | +| Deploy VM OS Disk Read Latency Alert | ALZ_VMOSDiskReadLatency | [deploy-vm-OSDiskreadLatency_alert.json](../../../services/Compute/virtualMachines/Deploy-VM-OSDiskReadLatency-Alert.json) | deployIfNotExists | +| Deploy VM OS Disk Write Latency Alert | ALZ_VMOSDiskWriteLatency | [deploy-vm-OSDiskwriteLatency_alert.json](../../../services/Compute/virtualMachines/Deploy-VM-OSDiskWriteLatency-Alert.json) | deployIfNotExists | +| Deploy VM OS Disk Space Alert | ALZ_VMOSDiskSpace | [deploy-vm-OSDiskSpace_alert.json](../../../services/Compute/virtualMachines/Deploy-VM-OSDiskSpace-Alert.json) | deployIfNotExists | +| Deploy VM CPU Alert | ALZ_VMPercentCPU | [deploy-vm-PercentCPU_alert.json](../../../services/Compute/virtualMachines/Deploy-VM-PercentCPU-Alert.json) | deployIfNotExists | +| Deploy VM Memory Alert | ALZ_VMPercentMemory | [deploy-vm-PercentMemory_alert.json](../../../services/Compute/virtualMachines/Deploy-VM-PercentMemory-Alert.json) | deployIfNotExists | +| Deploy VM Data Disk Space Alert | ALZ_VMDataDiskSpace | [deploy-vm-dataDiskSpace_alert.json](../../../services/Compute/virtualMachines/Deploy-VM-DataDiskSpace-Alert.json) | deployIfNotExists | +| Deploy VM Data Disk Read Latency Alert | ALZ_VMDataDiskReadLatency | [deploy-vm-dataDiskreadLatency_alert.json](../../../services/Compute/virtualMachines/Deploy-VM-DataDiskReadLatency-Alert.json) | deployIfNotExists | +| Deploy VM Data Disk Write Latency Alert | ALZ_VMDataDiskWriteLatency | [deploy-vm-dataDiskwriteLatency_alert.json](../../../services/Compute/virtualMachines/Deploy-VM-DataDiskWriteLatency-Alert.json) | deployIfNotExists | +| Deploy AGW ApplicationGatewayTotalTime Alert | ALZ_AGWTotalTime | [Deploy-AGW-ApplicationGatewayTotalTime-Alert.json](../../../services/Network/applicationGateways/Deploy-AGW-ApplicationGatewayTotalTime-Alert.json) | deployIfNotExists | +| Deploy AGW BackendLastByteResponseTime Alert | ALZ_AGWBackendLastByteResponseTime | [Deploy-AGW-BackendLastByteResponseTime-Alert.json](../../../services/Network/applicationGateways/Deploy-AGW-BackendLastByteResponseTime-Alert.json) | deployIfNotExists | +| Deploy AGW Capacity Units Alert | ALZ_AGWCapacityUnits | [Deploy-AGW-CapacityUnits-Alert.json](../../../services/Network/applicationGateways/Deploy-AGW-CapacityUnits-Alert.json) | deployIfNotExists | +| Deploy AGW Compute Units Alert | ALZ_AGWComputeUnits | [Deploy-AGW-ComputeUnits-Alert.json](../../../services/Network/applicationGateways/Deploy-AGW-ComputeUnits-Alert.json) | deployIfNotExists | +| Deploy AGW CPU Utilization Alert | ALZ_AGWCPUUtilization | [Deploy-AGW-CPUUtil-Alert.json](../../../services/Network/applicationGateways/Deploy-AGW-CPUUtil-Alert.json) | deployIfNotExists | +| Deploy AGW FailedRequests Alert | ALZ_AGWFailedRequests | [Deploy-AGW-FailedRequests-Alert.json](../../../services/Network/applicationGateways/Deploy-AGW-FailedRequests-Alert.json) | deployIfNotExists | +| Deploy AGW ResponseStatus Alert | ALZ_AGWResponseStatus | [Deploy-AGW-ResponseStatus-Alert.json](../../../services/Network/applicationGateways/Deploy-AGW-ResponseStatus-Alert.json) | deployIfNotExists | +| Deploy AGW Unhealthy Host Count Alert | ALZ_AGWUnhealthyHostCount | [Deploy-AGW-UnhealthyHostCount-Alert.json](../../../services/Network/applicationGateways/Deploy-AGW-UnhealthyHostCount-Alert.json) | deployIfNotExists | +| Deploy ALB Data Path Availability Alert | ALZ_LBDataPathAvailability | [Deploy-LB-DatapathAvailability-Alert.json](../../../services/Network/loadBalancers/Deploy-LB-DatapathAvailability-Alert.json) | deployIfNotExists | +| Deploy ALB Global Backend Availability Alert | ALZ_LBGlobalBackendAvailability | [Deploy-LB-GlobalBackendAvailability-Alert.json](../../../services/Network/loadBalancers/Deploy-LB-GlobalBackendAvailability-Alert.json) | deployIfNotExists | +| Deploy ALB Health Probe Status Alert | ALZ_LBHealthProbeStatus | [Deploy-LB-HealthProbeStatus-Alert.json](../../../services/Network/loadBalancers/Deploy-LB-HealthProbeStatus-Alert.json) | deployIfNotExists | +| Deploy ALB Used SNAT Ports Alert | ALZ_LBUsedSNATPorts | [Deploy-LB-HealthProbeStatus-Alert.json](../../../services/Network/loadBalancers/Deploy-LB-HealthProbeStatus-Alert.json) | deployIfNotExists | +| Deploy FrontDoor CDN Profile Origin Health Percentage Alert | ALZ_CDNPOriginHealthPercentage | [Deploy-CDNP-OriginHealthPercentage-Alert.json](../../../services/Cdn/profiles/Deploy-CDNP-OriginHealthPercentage-Alert.json) | deployIfNotExists | +| Deploy FrontDoor CDN Profile Origin Latency Alert | ALZ_CDNPOriginLatency | [Deploy-CDNP-OriginLatency-Alert.json](../../../services/Cdn/profiles/Deploy-CDNP-OriginLatency-Alert.json) | deployIfNotExists | +| Deploy FrontDoor CDN Profile Percentage4XX Alert | ALZ_CDNPPercentage4XX | [Deploy-CDNP-Percentage4XX-Alert.json](../../../services/Cdn/profiles/Deploy-CDNP-Percentage4XX-Alert.json) | deployIfNotExists | +| Deploy FrontDoor CDN Profile Percentage5XX Alert | ALZ_CDNPPercentage5XX | [Deploy-CDNP-Percentage5XX-Alert.json](../../../services/Cdn/profiles/Deploy-CDNP-Percentage5XX-Alert.json) | deployIfNotExists | +| Deploy Traffic Manager Endpoint Health Alert | ALZ_TMEndpointHealth | [Deploy-TM-EndpointHealth-Alert.json](../../../services/Network/trafficmanagerprofiles/Deploy-TM-EndpointHealth-Alert.json) | deployIfNotExists | +| Deploy App Service Plan CPU Percentage Alert | ALZ_WSFCPUPercentage | [Deploy-WSF-CPUPercentage-Alert.json](../../../services/Web/serverFarms/Deploy-WSF-CPUPercentage-Alert.json) | deployIfNotExists | +| Deploy App Service Plan Memory Percentage Alert | ALZ_WSFMemoryPercentage | [Deploy-WSF-MemoryPercentage-Alert.json](../../../services/Web/serverFarms/Deploy-WSF-MemoryPercentage-Alert.json) | deployIfNotExists | +| Deploy App Service Plan Disk Queue Length Alert | ALZ_WSFDiskQueueLength | [Deploy-WSF-DiskQueueLength-Alert.json](../../../services/Web/serverFarms/Deploy-WSF-DiskQueueLength-Alert.json) | deployIfNotExists | +| Deploy App Service Plan Http Queue Length Alert | ALZ_WSFHttpQueueLength | [Deploy-WSF-HttpQueueLength-Alert.json](../../../services/Web/serverFarms/Deploy-WSF-HttpQueueLength-Alert.json) | deployIfNotExists | +| Deploy Frontdoor Backend Health Percentage Alert | ALZ_FDBackendHealth | [Deploy-FD-BackendHealth-Alert.json](../../../services/Network/frontDoors/Deploy-FD-BackendHealth-Alert.json) | deployIfNotExists | +| Deploy Frontdoor Backend Request Latency Alert | ALZ_FDBackendRequestLatency | [Deploy-FD-BackendRequestLatency-Alert.json](../../../services/Network/frontDoors/Deploy-FD-BackendRequestLatency-Alert.json) | deployIfNotExists | diff --git a/docs/content/patterns/alz/Telemetry.md b/docs/content/patterns/alz/Telemetry.md index c9b83fe9c..fe34c0a7c 100644 --- a/docs/content/patterns/alz/Telemetry.md +++ b/docs/content/patterns/alz/Telemetry.md @@ -63,10 +63,17 @@ The following are the unique ID's (also known as PIDs) used in the AMBA deployme | Azure Monitor Baseline Alerts - AMBA Portal Accelerator Deployments | dddb1f42-f9d8-48e3-9e6b-f1ce3e9c2c76 | Deplyments performed through the AMBA Portal Accelerator | | Azure Monitor Baseline Alerts - Bicep Deployments | 8fdd7c49-68f6-4e35-8ba3-ee0dd2979bc0 | Deplyments performed through Bicep | | Azure Monitor Baseline Alerts - Terraform Deployments | da02c554-db8c-4029-96dd-d4ab9abf4dc4 | Deplyments performed through Terraform | -| Connectivity Policy Initiative | 2d69aa07-8780-4697-a431-79882cb9f00e | Usage of Connectivity Policy initiative alerts | -| Identity Policy Initiative | 8d257c20-97bf-4d14-acb3-38dd1436d13a | Usage of Identity Policy initiative alerts | -| Management Policy Initiative | d87415c4-01ef-4667-af89-0b5adc14af1b | Usage of Management Policy initiative alerts | -| LandingZone Policy Initiative | 7bcfc615-be78-43da-b81d-98959a9465a5 | Usage of LandingZone Policy initiative alerts | -| Hybrid VM Initiative | b5c25c0c-dfbf-4414-bedb-f48ab00d0f9e | Usage of Hybrid VM Policy initiative alerts | -| ServiceHealth Policy Initiative | 860d2afd-b71e-452f-9d3a-e56196cba570 | Usage of ServiceHealth Policy initiative alerts | -| Notification Assets Policy Initiative | eabaaf0b-eed4-48a9-9f91-4f7e431ba807 | Usage of Notification Assets Policy initiative alerts | +| Connectivity Policy Initiative | 2d69aa07-8780-4697-a431-79882cb9f00e | Usage of Connectivity Policy initiative | +| Identity Policy Initiative | 8d257c20-97bf-4d14-acb3-38dd1436d13a | Usage of Identity Policy initiative | +| Management Policy Initiative | d87415c4-01ef-4667-af89-0b5adc14af1b | Usage of Management Policy initiative | +| LandingZone Policy Initiative (Initiative has been deprecated) | 7bcfc615-be78-43da-b81d-98959a9465a5 | Usage of LandingZone Policy initiative | +| Hybrid VM Policy Initiative | b5c25c0c-dfbf-4414-bedb-f48ab00d0f9e | Usage of Hybrid VM Policy initiative | +| ServiceHealth Policy Initiative | 860d2afd-b71e-452f-9d3a-e56196cba570 | Usage of ServiceHealth Policy initiative | +| Notification Assets Policy Initiative | eabaaf0b-eed4-48a9-9f91-4f7e431ba807 | Usage of Notification Assets Policy initiative | +| Key Management Policy Initiative | 65cb78a2-0744-4785-9093-aeb772ecdd7b | Usage of Key Management Policy initiative | +| Load Balancing Policy Initiative | 5156f7d1-8543-49c0-ac09-76db1170d42a | Usage of Load Balancing Policy initiative | +| Network Changes Policy Initiative | e61a27ea-ed9e-496e-8fd2-489bfa3b6e4f | Usage of Network Changes Policy initiative | +| Recovery Services Policy Initiative | b45e8b7b-e0a2-4af4-b3af-8b2af4020dcc | Usage of Recovery Services Policy initiative | +| Storage Policy Initiative | c0eb5ea9-033b-4c1b-be71-b3088e7a2e2b | Usage of Storage Policy initiative | +| VM Policy Initiative | 3ace674d-9502-4f4a-98ba-a2277c01ccf8 | Usage of VM Policy initiative | +| Web Policy Initiative | a80aedbd-3157-4335-94c7-7e7db459a647 | Usage of Web Policy initiative | diff --git a/docs/content/patterns/alz/Moving-from-preview-to-GA.md b/docs/content/patterns/alz/UpdateToNewReleases/Moving-from-preview-to-GA.md similarity index 99% rename from docs/content/patterns/alz/Moving-from-preview-to-GA.md rename to docs/content/patterns/alz/UpdateToNewReleases/Moving-from-preview-to-GA.md index 5ba3ac794..dc7def0e0 100644 --- a/docs/content/patterns/alz/Moving-from-preview-to-GA.md +++ b/docs/content/patterns/alz/UpdateToNewReleases/Moving-from-preview-to-GA.md @@ -1,7 +1,7 @@ --- title: Moving from preview to GA geekdocCollapseSection: true -weight: 70 +weight: 101 --- When moving from the preview version to GA, it is required to remove everything deployed by the ALZ Monitor solution. The instructions below detail execution of a PowerShell script to delete all resources deployed, including: diff --git a/docs/content/patterns/alz/UpdateToNewReleases/Update_from_release_2024-06-05.md b/docs/content/patterns/alz/UpdateToNewReleases/Update_from_release_2024-06-05.md new file mode 100644 index 000000000..ec37588fa --- /dev/null +++ b/docs/content/patterns/alz/UpdateToNewReleases/Update_from_release_2024-06-05.md @@ -0,0 +1,49 @@ +--- +title: Updating from release 2024-06-05 +geekdocCollapseSection: true +weight: 97 +--- +{{< hint type=Important >}} +***Updating to release from release [2024-06-05](../../Whats-New#2024-06-05) or from previous releases, contains a breaking change. To perform the update, it's required to remove previously deployed policy definitions, policy set definitions, policy assignments and role assignments. As part of this release we made a script available to clean all the necessary items. ***It's strongly recommended that you test the script thoroughly before running on production environment. It isn't necessary to remove alert definitions that will continue to work in the meantime.*** +{{< /hint >}} + +# Pre update actions + +Before updating to release [2024-06-30](../../Whats-New#2024-06-30), it's required to remove existing policy definitions, policy set definitions, policy assignments and role assignments. This action is required because of a breaking change caused by the redefinition of some parameters, which allows for more flexibility in disabling the policy remediation or, in some cases, the alerts. Unfortunately not all the alerts can be disabled after creation; only log-based alerts can be. Even if disabling the effect of policy was already possible in AMBA-ALZ, with this release we made sure that all the policies will honor both the ***PolicyEffect*** and the ***MonitorDisable*** parameters. + +In particular, the *MonitorDisable* feature has been redesigned to allow customer to specify they own existing tag and tag value instead of forcing a hard coded one. Given the ALZ guidance and the best practice of having a consistent tagging definition, it's only allowed to one parameter name fo r the entire deployment. Instead, parameter value can be different. You can specify an array of values assigned to the same parameter. For instance, you have the ```Environment``` tag name consistently applied to several environments, saying ```Production```, ```Test```, ```Sandbox```, and so on and you want to disable alerts for resources, which are in both ```Test``` and ```Sandbox```. Now it's possible by just configuring the parameters for tag name and tag values as reported in the sample screenshot (these are the default values) below: + +![MonitorDisable* parameters](../../media/MonitorDisableParams.png) + +Complete description of this new/redesigned feature can be found in the [MonitorDisable parameter](../../Disabling-Policies#monitordisable-parameter) paragraph inside the [Disabling Policies](../../Disabling-Policies) page. + +Once the policy definitions, policy set definitions, policy assignments and role assignments are removed and the deployment is completed, the execution of [Policy remediation](../../deploy/Remediate-Policies) will ensure that the new alerts will be created accordingly. + +To run the script, complete the following steps: + + 1. Open PowerShell + 2. Install the **Az.ResourceGraph** module: `Install-Module Az.ResourceGraph` (if not present) + 3. Change directory to `patterns\alz\scripts`, there you find the **Start-AMBAPolicyInitiativesAndAssignmentsCleanup.ps1** script + 4. Configure the ***$pseudoRootManagementGroup*** variable using the following command: + + ```powershell + $pseudoRootManagementGroup = "The pseudo root management group id parenting the identity, management and connectivity management groups" + ``` + + 1. Sign in to the Azure with the `Connect-AzAccount` command. The account you sign in as needs to have permissions to remove policy definitions, policy set definitions, policy assignments and role assignments at the desired Management Group scope. + + 2. Execute the script using one of the following options: + + {{% include "PowerShell-ExecutionPolicy.md" %}} + + **Generate a list of policy definitions, policy set definitions, policy assignments and role assignments resources which would be deleted by this script:** + + ```powershell + ./Start-AMBAPolicyInitiativesAndAssignmentsCleanup.ps1 -pseudoRootManagementGroup $pseudoRootManagementGroup -ReportOnly + ``` + + **Delete policy definitions, policy set definitions, policy assignments and role assignments resources deployed by the AMBA-ALZ pattern without prompting for confirmation:** + + ```powershell + ./Start-AMBAPolicyInitiativesAndAssignmentsCleanup.ps1 -pseudoRootManagementGroup $pseudoRootManagementGroup -Force + ``` diff --git a/docs/content/patterns/alz/Whats-New.md b/docs/content/patterns/alz/Whats-New.md index 4d13f6442..7f0e0dff3 100644 --- a/docs/content/patterns/alz/Whats-New.md +++ b/docs/content/patterns/alz/Whats-New.md @@ -8,6 +8,51 @@ For information on what's new please refer to the [Releases](https://github.com/ To update your current deployment with the content from the latest release, please refer to the [Update to new releases](../UpdateToNewReleases) page. +## 2024-08-30 + +### New features + +- **AMBA Portal Accelerator**: We are thrilled to introduce the Azure Monitor Baseline Alerts Accelerator, now available in preview! The new deployment method is accessible directly through the Azure Portal UI, providing a user-friendly interface that guides you through the setup process. This means you can deploy alerts faster and with greater confidence. It simplifies the process of setting up baseline alerts, ensuring that you are promptly notified of critical metrics and log anomalies that could indicate potential issues with your Azure deployments. To begin using the AMBA Portal Accelerator click the Deploy to Azure button below. Please refer to the detailed deployment instructions for further guidance. [Deploy via the Azure Portal (Preview)](../deploy/Deploy-via-Azure-Portal-UI) +- **Modular approach to Initiatives**: Recognizing the limitations of a monolithic approach, we have deprecated the former Landing Zone Initiative. The initiative was becoming too large and impractical. Instead, We have adopted a modular approach by splitting the initiative into the following distinct components. For more details please visit: [Policy Initiatives](../Policy-Initiatives) + - Key Management + - Load Balancing + - Network Changes + - Recovery Services + - Storage + - VM + - Web +- **Threshold Override:** Some resources need thresholds different from the baseline set in the Policy Definition. The Alert Threshold Override feature lets both Greenfield and Brownfield customers adjust these thresholds for specific resources, before or after deployment. By using a tag with a specific name and value, you can override the default alert threshold. This custom threshold applies only to the tagged resources, replacing the global parameter value. This feature is available only for metrics and log alerts. Learn more: [Alert Threshold Override](../Available_features/Threshold-Override) +- **Custom tags and values to disable monitoring**: The updated feature lets you specify both a tag name and a list of values. For example, if you have an "Environment" tag with values like "Production," "Development," or "Sandbox," you can deploy alerts only for "Production" resources by disabling monitoring for those tagged as "Development" and "Sandbox." +- Added new alert rule for Azure Key Vault Managed HSM. This has been included in both the Identity and Key Mananagement initiatives. +- Added new Daily Cap threshold alert on a Log Analytics workspace. This alert has been added to the Management initiative. +- Added new Application Insight Throttling alert. Included in the Web initiative. +- Added new ActivityLog Alert for deleting Application Insight. Added to the Web initiative. +- Added the ability to change the Application Gateway dynamic alert sensitivity +- **Deprecated** the Landing Zone Initiative + +### Bug fixes + +- Fixed [[#280](https://github.com/Azure/azure-monitor-baseline-alerts/issues/280)]: AGW Compute Units Alert and AGW Unhealthy Host Count Alert remain non-compliant after successful remediation +- Fixed [[#278](https://github.com/Azure/azure-monitor-baseline-alerts/issues/278)]: Deploy VNetG ExpressRoute CPU Utilization Alert remediation fails +- Fixed [[#284](https://github.com/Azure/azure-monitor-baseline-alerts/issues/284)]: AMBA policy ALZ_ServiceHealth_ActionGroups Missing when remediating AMBA policies +- Fixed [[#253](https://github.com/Azure/azure-monitor-baseline-alerts/issues/253)]: Deploying AMBA, older version used in documentation +- Fixed [[#261](https://github.com/Azure/azure-monitor-baseline-alerts/issues/261)]: displayname VMLowOSDisk(Write/Read)LatencyAlert should be VMHighOSDisk(Write/Read)LatencyAlert +- Fixed [[#260](https://github.com/Azure/azure-monitor-baseline-alerts/issues/260)]: No treshold parameter for ALZ alerts ALZ_WSFMemoryPercentage, ALZ_WSFCPUPercentage. +- Fixed casing in metadata. +- Fixed casing in policies. +- Fixed default values for multiple parameters used in the VM and Hybrid initiatives. + +### Documentation updates + +- Added new policies for ExpressRoute Ports to Connectivity table. [Policy Initiatives](../Policy-Initiatives) +- Documentation update about unsupported/unrecommended Tenant Root Group deployment. [FAQ](../FAQ) +- New guidance for bringing you own Managed Identity. [Bring Your Own User Assigned Managed Identity](../Available_features/Bring-Your-Own-User-Assigned-Managed-Identity) +- Update the Policy Initiatives documentation to include the Policy Reference ID and update the Policy Name column to use the display name of all the policies. [Policy Initiatives](../Policy-Initiatives) + +### Tools + +- **Automation**: New workflow that automates the process of creating ARM templates for Azure Policies/ PolicySets. The workflow is triggered by a pull request event and uses a bicep build to generate the templates. + ## 2024-06-05 ### New features diff --git a/docs/content/patterns/alz/deploy/Customize-Policy-Assignment.md b/docs/content/patterns/alz/deploy/Customize-Policy-Assignment.md index 0fd89f9c5..54151d44d 100644 --- a/docs/content/patterns/alz/deploy/Customize-Policy-Assignment.md +++ b/docs/content/patterns/alz/deploy/Customize-Policy-Assignment.md @@ -14,7 +14,7 @@ As an example you may want to change alert thresholds for one or more metric ale ### Parameter file -- [alzArm.param.json](https://github.com/azure/azure-monitor-baseline-alerts/blob/main/patterns/alz/alzArm.param.json) +- [alzArm.param.json](https://github.com/azure/azure-monitor-baseline-alerts/blob/2024-08-30/patterns/alz/alzArm.param.json) ### Applying changes to the parameter file diff --git a/docs/content/patterns/alz/deploy/Deploy-only-Service-Health-Alerts.md b/docs/content/patterns/alz/deploy/Deploy-only-Service-Health-Alerts.md index 7deda0aac..61d3e4dd1 100644 --- a/docs/content/patterns/alz/deploy/Deploy-only-Service-Health-Alerts.md +++ b/docs/content/patterns/alz/deploy/Deploy-only-Service-Health-Alerts.md @@ -4,10 +4,6 @@ geekdocCollapseSection: true weight: 70 --- -{{< hint type=Important >}} -Updating from the _**preview**_ version isn't supported. If you deployed the _**preview**_ version, proceed with [Moving from preview to GA](../../Moving-from-preview-to-GA) before continuing. -{{< /hint >}} - The following guide describes the steps to use the ALZ pattern to implement Service Health Alerts. When you deploy one Policy Set Definition, like Service Health, you will only need the Policy Definitions required by that Policy Set Definition. You can still choose to deploy all Policy Definitions that are provided in the ALZ Pattern, this is recommended when you want to deploy other Policy Set Definitions in the future. In case you first deploy a subset of the Policy Definitions, you can easily deploy additional definitions at a later stage. This document covers two deployment options: 1. [Quick Deployment](../Deploy-only-Service-Health-Alerts/#quick-deployment): Deploys the ALZ Pattern including all Policy Definitions, Policy Set Definitions, however, this assigns only the Service Health Policy Set Definition. @@ -23,7 +19,7 @@ In this example we will deploy the Service Health Policy Set Definition via Azur To start, you can either download a copy of the parameter file or clone/fork the repository. -- [alzArm.param.json](https://github.com/azure/azure-monitor-baseline-alerts/blob/main/patterns/alz/alzArm.param.json) +- [alzArm.param.json](https://github.com/azure/azure-monitor-baseline-alerts/blob/2024-08-30/patterns/alz/alzArm.param.json) The following changes apply to all scenarios, whether you are aligned or unaligned with ALZ or have a single management group. @@ -190,7 +186,7 @@ The ```location``` variable refers to the deployment location. Deploying to mult Using your preferred command-line tool (Windows PowerShell, Cmd, Bash or other Unix shells), if you closed your previous session, navigate again to the root of the cloned repo and log on to Azure with an account with at least Resource Policy Contributor access at the root of the management group hierarchy where you will be creating the policies and Policy Set Definitions. ```bash -az deployment mg create --template-uri https://raw.githubusercontent.com/Azure/azure-monitor-baseline-alerts/2024-03-01/patterns/alz/alzArm.json --name "amba-GeneralDeployment" --location $location --management-group-id $pseudoRootManagementGroup --parameters .\patterns\alz\alzArm.param.json +az deployment mg create --template-uri https://raw.githubusercontent.com/Azure/azure-monitor-baseline-alerts/2024-08-30/patterns/alz/alzArm.json --name "amba-GeneralDeployment" --location $location --management-group-id $pseudoRootManagementGroup --parameters .\patterns\alz\alzArm.param.json ```
diff --git a/docs/content/patterns/alz/deploy/Deploy-via-Azure-Portal-UI.md b/docs/content/patterns/alz/deploy/Deploy-via-Azure-Portal-UI.md new file mode 100644 index 000000000..6569e8971 --- /dev/null +++ b/docs/content/patterns/alz/deploy/Deploy-via-Azure-Portal-UI.md @@ -0,0 +1,109 @@ +--- +title: Deploy via the Azure Portal (Preview) +weight: 30 +--- + +[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/amba/alz/portal) + +## Deployment Settings Blade + +![Deployment Settings Blade](../../media/PortalAccelerator/DeploymentSettings.png) + +- Change the values on the Deployment Settings blade to the instructions below: + - Choose the Management Group where you wish to deploy the policies and the initiatives. This is usually the so called "pseudo root management group", for example, in [ALZ terminology](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups), this would be the so called "Intermediate Root Management Group" (directly beneath the "Tenant Root Group"). + - Choose the value of _`Region`_ to specify your Azure location of choice. + - Change the value of _`Resource group for baseline alerts`_ to the name of the resource group where the activity logs, resource health alerts, actions groups and alert processing rules will be deployed in. + - Choose the value of _`Resource group location`_ to specify the location for said resource group. + - Choose the value of _`Bring Your Own User Assigned Managed Identity`_ to specify if you want to bring your own user assigned managed identity for monitoring purpose. + - Define the value of _`User Assigned Managed Identity Name`_ to specify the name of the user assigned managed identity for monitoring purpose. + - Choose the value of _`Bring Your Own User Assigned Managed Identity Resource Id`_ to specify the resource id of the user assigned managed identity if you want to bring your own user assigned managed identity for monitoring purpose. + - Choose the value of _`Management Subscription Id`_ to specify the subscription id where the user assigned managed identity will be created. + - Choose the value of _`Customer Usage Selection Option`_ Microsoft can identify the deployments of the Azure Resource Manager and Bicep templates with the deployed Azure resources. Microsoft can correlate these resources used to support the deployments. Microsoft collects this information to provide the best experiences with their products and to operate their business. The telemetry is collected through customer usage attribution. The data is collected and governed by Microsoft’s privacy policies, located at the trust center. + - Change the value of _`Resource Group Tags`_ to specify the tags to be added to said resource group. + +## Management Groups Settings Blade + +- Change the values on the Management Groups Settings blade to the instructions below: + +![Management Groups Settings Blade](../../media/PortalAccelerator/MGSettings.png) + +### If you are aligned to ALZ + +- Choose the value of _`Enterprise Scale Company Management Group`_ to the management group id for Platform. +- Choose the value of _`Identity Management Group`_ to the management group id for Identity. +- Choose the value of _`Management Management Group`_ to the management group id for Management. +- Choose the value of _`Connectivity Management Group`_ to the management group id for Connectivity. +- Choose the value of _`Landing Zone Management Group`_ to the management group id for Landing Zones. + +### If you are unaligned to ALZ + +- Choose the value of _`Enterprise Scale Company Management Group`_ to the management group id for Platform. The same management group id may be repeated. +- Choose the value of _`Identity Management Group`_ to the management group id for Identity. The same management group id may be repeated. +- Choose the value of _`Management Management Group`_ to the management group id for Management. The same management group id may be repeated. +- Choose the value of _`Connectivity Management Group`_ to the management group id for Connectivity. The same management group id may be repeated. +- Choose the value of _`Landing Zone Management Group`_ to the management group id for Landing Zones. The same management group id may be repeated. + +{{< hint type=note >}} +For ease of deployment and maintenance we have kept the same variables. +{{< /hint >}} + +### If you have a single management group + +- Choose the value of _`Enterprise Scale Company Management Group`_ to the pseudo root management group id, also called the "Intermediate Root Management Group". +- Choose the value of _`Identity Management Group`_ to the pseudo root management group id, also called the "Intermediate Root Management Group". +- Choose the value of _`Management Management Group`_ to the pseudo root management group id, also called the "Intermediate Root Management Group". +- Choose the value of _`Connectivity Management Group`_ to the pseudo root management group id, also called the "Intermediate Root Management Group". +- Choose the value of _`Landing Zone Management Group`_ to the pseudo root management group id, also called the "Intermediate Root Management Group". + +{{< hint type=note >}} +For ease of deployment and maintenance we have kept the same variables. +{{< /hint >}} + +- Change the value of _`Enable AMBA Hybrid VM`_ to _`Yes`_ This initiative deploys Azure Monitor Baseline Alerts to monitor Azure Arc-enabled Servers. +- Change the value of _`Enable AMBA Key Management`_ to _`Yes`_ This initiative deploys Azure Monitor Baseline Alerts to monitor Key Management Services such as Azure Key Vault, and Managed HSM. +- Change the value of _`Enable AMBA Load Balancing`_ to _`Yes`_ This initiative deploys Azure Monitor Baseline Alerts to monitor Load Balancing Services such as Load Balancer, Application Gateway, Traffic Manager, and Azure Front Door. +- Change the value of _`Enable AMBA Network Changes`_ to _`Yes`_ This initiative implements Azure Monitor Baseline Alerts to monitor alterations in Network Routing and Security, such as modifications to Route Tables and the removal of Network Security Groups. +- Change the value of _`Enable AMBA Recovery Services`_ to _`Yes`_ This initiative deploys Azure Monitor Baseline Alerts to monitor Recovery Services such as Azure Backup, and Azure Site Recovery. +- Change the value of _`Enable AMBA Storage`_ to _`Yes`_ This initiative deploys Azure Monitor Baseline Alerts to monitor Storage Services such as Storage accounts. +- Change the value of _`Enable AMBA VM`_ to _`Yes`_ This initiative deploys Azure Monitor Baseline Alerts to monitor Azure Virtual Machines. +- Change the value of _`Enable AMBA Web`_ to _`Yes`_ This initiative deploys Azure Monitor Baseline Alerts to monitor Web Services such as App Services. +- Change the value of _`Enable AMBA notification assets`_ to _`Yes`_ In this scenario, the deployment will Deploy notification assets for Service Health alerts and wide notifications. +- Change the value of _`Enable AMBA Service Health`_ to _`Yes`_ In this scenario, the deployment will assign the Service Health Policy Set Definition. + +## Notification Settings Blade + +![Notification Settings Blade](../../media/PortalAccelerator/NotificationSettings.png) + +{{< hint type=note >}} +While it's technically possible to not add any notification information (no email, no ARM Role, no Logic App, etc.) it is strongly recommended to configure at least one option. +{{< /hint >}} + +- Change values on the Notification Settings Blade blade to the instructions below: + + - Change the value of _`Bring Your Own Notifications (BYON)`_ to _` Yes`_ if you wish to use existing Action Groups and Alert Processing Rule. The BYON feature works by setting the necessary parameter values before running the ALZ pattern deployment. Customers have the choice to either specify one or more existing AGs and one APR or to enter target values so the AG and the APR will be created using the actions specified in the parameter file (including the option to not specify any value and creating an empty AG). + - Change the value of _`Email contact for action group notifications`_ to the email address(es) where notifications of the alerts (including Service Health alerts) are sent to. Leave the value blank if no email notification is used. + - Change the value of _`Webhook Service Uri`_ to the URI(s) to be used as action for the alerts (including Service Health alerts). Leave the value blank if no Webhook is used. + - Choose the value of _`Arm Role Id`_ to the Azure Resource Manager Role(s) where notifications of the alerts (including Service Health alerts) are sent to. Leave the value blank if no Azure Resource Manager Role notification is required. + - Change the value of _`Logicapp Resource Id`_ to the Logic app resource id to be used as action for the alerts (including Service Health alerts). Leave the value blank if no Logic app is used. + - Change the value of _`Logicapp Callback Url`_ to the Logic app callback url of the Logic app you want to use as action for the alerts (including Service Health alerts). Leave the value blank if no Logic app is used. To retrieve the callback url you can either use the [_**Get-AzLogicAppTriggerCallbackUrl**_](https://learn.microsoft.com/en-us/powershell/module/az.logicapp/get-azlogicapptriggercallbackurl) PowerShell command or navigate to the Logic app in the Azure portal, go to _**Logic app designer**_, expand the trigger activity (_When an HTTP request is received_) and copy the value in the URL field using the 2-sheets icon. + + ![Get Logic app callback url](../../media/AMBA-LogicAppCallbackUrl.png) + + - Change the value of _`Event Hub Resource Id`_ to the Event Hubs to be used as action for the alerts (including Service Health alerts). Leave the value blank if no Event Hubs is used. + - Change the value of _`Function Resource Id`_ to the Function resource id to be used as action for the alerts (including Service Health alerts). Leave the value blank if no Function is used. + - Change the value of _`Function Trigger Url`_ to the Function App trigger url of the function to be used as action for the alerts (including Service Health alerts). Leave the value blank if no Function is used. To retrieve the Function App trigger url with the corresponding code, navigate to the HTTP-triggered functions in the Azure portal, go to _**Code + Test**_, select **Get function URL** from the menu top menu and copy the value in the URL field using the 2-sheets icon. + + ![Get function URL](../../media/AMBA-FunctionAppTriggerUrl.png) + + {{< hint type=note >}} + It is possible use multiple email addresses, as well as multiple Arm Roles, Webhooks or Event Hubs (not recommended as per ALZ guidance). Should you set multiple entries, make sure they are entered as an array. Example: + + `["action1@contoso.com","action2@contoso.com","action3@contoso.com"]` + + `["https://webhookUri1.webhook.com","http://webhookUri2.webhook.com"]` + + {{< /hint >}} + +## Next steps + +To remediate non-compliant policies, continue with [Policy remediation](../Remediate-Policies) diff --git a/docs/content/patterns/alz/deploy/Deploy-with-Azure-CLI.md b/docs/content/patterns/alz/deploy/Deploy-with-Azure-CLI.md index 5a9b8a4e3..b1dbb861e 100644 --- a/docs/content/patterns/alz/deploy/Deploy-with-Azure-CLI.md +++ b/docs/content/patterns/alz/deploy/Deploy-with-Azure-CLI.md @@ -42,7 +42,7 @@ If you customized the policies as documented at [How to modify individual polici {{< /hint >}} ```bash -az deployment mg create --name "amba-GeneralDeployment" --template-uri https://raw.githubusercontent.com/Azure/azure-monitor-baseline-alerts/2024-03-01/patterns/alz/alzArm.json --location $location --management-group-id $pseudoRootManagementGroup --parameters ".\patterns\alz\alzArm.param.json" +az deployment mg create --name "amba-GeneralDeployment" --template-uri https://raw.githubusercontent.com/Azure/azure-monitor-baseline-alerts/2024-09-02/patterns/alz/alzArm.json --location $location --management-group-id $pseudoRootManagementGroup --parameters ".\patterns\alz\alzArm.param.json" ``` ## Next steps diff --git a/docs/content/patterns/alz/deploy/Deploy-with-Azure-PowerShell.md b/docs/content/patterns/alz/deploy/Deploy-with-Azure-PowerShell.md index 44eb1fabc..27e2e28af 100644 --- a/docs/content/patterns/alz/deploy/Deploy-with-Azure-PowerShell.md +++ b/docs/content/patterns/alz/deploy/Deploy-with-Azure-PowerShell.md @@ -50,7 +50,7 @@ If you customized the policies as documented at [How to modify individual polici {{< /hint >}} ```powershell -New-AzManagementGroupDeployment -Name "amba-GeneralDeployment" -ManagementGroupId $pseudoRootManagementGroup -Location $location -TemplateUri "https://raw.githubusercontent.com/Azure/azure-monitor-baseline-alerts/2024-03-01/patterns/alz/alzArm.json" -TemplateParameterFile ".\patterns\alz\alzArm.param.json" +New-AzManagementGroupDeployment -Name "amba-GeneralDeployment" -ManagementGroupId $pseudoRootManagementGroup -Location $location -TemplateUri "https://raw.githubusercontent.com/Azure/azure-monitor-baseline-alerts/2024-09-02/patterns/alz/alzArm.json" -TemplateParameterFile ".\patterns\alz\alzArm.param.json" ``` ## Next steps diff --git a/docs/content/patterns/alz/deploy/Remediate-Policies.md b/docs/content/patterns/alz/deploy/Remediate-Policies.md index c0ca7d5bd..c064d637c 100644 --- a/docs/content/patterns/alz/deploy/Remediate-Policies.md +++ b/docs/content/patterns/alz/deploy/Remediate-Policies.md @@ -51,13 +51,18 @@ $LZManagementGroup="The management group id for Landing Zones" ```powershell #Run the following commands to initiate remediation -.\patterns\alz\scripts\Start-AMBARemediation.ps1 -managementGroupName $managementManagementGroup -policyName Alerting-Management +.\patterns\alz\scripts\Start-AMBARemediation.ps1 -managementGroupName $pseudoRootManagementGroup -policyName Notification-Assets +.\patterns\alz\scripts\Start-AMBARemediation.ps1 -managementGroupName $pseudoRootManagementGroup -policyName Alerting-ServiceHealth .\patterns\alz\scripts\Start-AMBARemediation.ps1 -managementGroupName $connectivityManagementGroup -policyName Alerting-Connectivity .\patterns\alz\scripts\Start-AMBARemediation.ps1 -managementGroupName $identityManagementGroup -policyName Alerting-Identity -.\patterns\alz\scripts\Start-AMBARemediation.ps1 -managementGroupName $LZManagementGroup -policyName Alerting-LandingZone +.\patterns\alz\scripts\Start-AMBARemediation.ps1 -managementGroupName $managementManagementGroup -policyName Alerting-Management +.\patterns\alz\scripts\Start-AMBARemediation.ps1 -managementGroupName $LZManagementGroup -policyName Alerting-KeyManagement +.\patterns\alz\scripts\Start-AMBARemediation.ps1 -managementGroupName $LZManagementGroup -policyName Alerting-LoadBalancing +.\patterns\alz\scripts\Start-AMBARemediation.ps1 -managementGroupName $LZManagementGroup -policyName Alerting-NetworkChanges .\patterns\alz\scripts\Start-AMBARemediation.ps1 -managementGroupName $LZManagementGroup -policyName Alerting-HybridVM -.\patterns\alz\scripts\Start-AMBARemediation.ps1 -managementGroupName $pseudoRootManagementGroup -policyName Alerting-ServiceHealth -.\patterns\alz\scripts\Start-AMBARemediation.ps1 -managementGroupName $pseudoRootManagementGroup -policyName Notification-Assets +.\patterns\alz\scripts\Start-AMBARemediation.ps1 -managementGroupName $LZManagementGroup -policyName Alerting-Storage +.\patterns\alz\scripts\Start-AMBARemediation.ps1 -managementGroupName $LZManagementGroup -policyName Alerting-VM +.\patterns\alz\scripts\Start-AMBARemediation.ps1 -managementGroupName $LZManagementGroup -policyName Alerting-Web ``` Should you need to remediate just one policy definition and not the entire policy initiative, you can run the remediation script targeted at the policy reference id that can be found under [Policy Initiatives](../../Policy-Initiatives). For example, to remediate the ***Deploy AMBA Notification Assets*** policy, run the command below: diff --git a/docs/content/patterns/alz/deploy/parameterConfiguration.md b/docs/content/patterns/alz/deploy/parameterConfiguration.md index e545ac0f3..7eca7d721 100644 --- a/docs/content/patterns/alz/deploy/parameterConfiguration.md +++ b/docs/content/patterns/alz/deploy/parameterConfiguration.md @@ -2,15 +2,12 @@ title: Parameter configuration geekdocHidden: true --- -{{< hint type=Important >}} -Updating from the _**preview**_ version is not supported. If you deployed the _**preview**_ version, please proceed with [Moving from preview to GA](../../Moving-from-preview-to-GA) before continuing. -{{< /hint >}} ## 1. Parameter configuration To start, you can either download a copy of the parameter file or clone/fork the repository. -- [alzArm.param.json](https://github.com/azure/azure-monitor-baseline-alerts/blob/main/patterns/alz/alzArm.param.json) +- [alzArm.param.json](https://github.com/azure/azure-monitor-baseline-alerts/blob/2024-09-02/patterns/alz/alzArm.param.json) The following changes apply to all scenarios, whether you are aligned or unaligned with ALZ or have a single management group. diff --git a/docs/content/patterns/alz/media/LogsearchAlerts-OverrideThresholdAtWork.png b/docs/content/patterns/alz/media/LogsearchAlerts-OverrideThresholdAtWork.png new file mode 100644 index 000000000..cb28f9add Binary files /dev/null and b/docs/content/patterns/alz/media/LogsearchAlerts-OverrideThresholdAtWork.png differ diff --git a/docs/content/patterns/alz/media/MetricAlerts-OverrideThresholdAtWork.png b/docs/content/patterns/alz/media/MetricAlerts-OverrideThresholdAtWork.png new file mode 100644 index 000000000..3d3417470 Binary files /dev/null and b/docs/content/patterns/alz/media/MetricAlerts-OverrideThresholdAtWork.png differ diff --git a/docs/content/patterns/alz/media/MonitorDisableParams.png b/docs/content/patterns/alz/media/MonitorDisableParams.png new file mode 100644 index 000000000..9ee62a5b8 Binary files /dev/null and b/docs/content/patterns/alz/media/MonitorDisableParams.png differ diff --git a/docs/content/patterns/alz/media/PortalAccelerator/DeploymentSettings.png b/docs/content/patterns/alz/media/PortalAccelerator/DeploymentSettings.png new file mode 100644 index 000000000..04d46e950 Binary files /dev/null and b/docs/content/patterns/alz/media/PortalAccelerator/DeploymentSettings.png differ diff --git a/docs/content/patterns/alz/media/PortalAccelerator/MGSettings.png b/docs/content/patterns/alz/media/PortalAccelerator/MGSettings.png new file mode 100644 index 000000000..800090a81 Binary files /dev/null and b/docs/content/patterns/alz/media/PortalAccelerator/MGSettings.png differ diff --git a/docs/content/patterns/alz/media/PortalAccelerator/NotificationSettings.png b/docs/content/patterns/alz/media/PortalAccelerator/NotificationSettings.png new file mode 100644 index 000000000..7c8f6b1d6 Binary files /dev/null and b/docs/content/patterns/alz/media/PortalAccelerator/NotificationSettings.png differ diff --git a/patterns/alz/alz-portal.json b/patterns/alz/alz-portal.json new file mode 100644 index 000000000..0be32ea1e --- /dev/null +++ b/patterns/alz/alz-portal.json @@ -0,0 +1,958 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2021-09-09/uiFormDefinition.schema.json#", + "view": { + "kind": "Form", + "properties": { + "title": "Azure Monitor Baseline Alerts Accelerator (Preview)", + "steps": [ + { + "name": "basics", + "label": "Deployment Settings", + "elements": [ + { + "name": "baselinealertsintro", + "type": "Microsoft.Common.InfoBox", + "visible": true, + "options": { + "text": "AMBA Accelerator will automatically import all policies and initiatives and will assign the Deploy Azure Monitor Baseline Alerts for Service Health policy initiative at the intermediate root. While it´s recommended to implement the alert policies and initiatives to an ALZ Management Group hierarchy, it is not a technical requirement. These policies and initiatives can be implemented in existing brownfield scenarios that don´t adhere to the ALZ Management Group hierarchy. For example, in hierarchies where there is a single management group, or where the structure does not align to ALZ. At least one management group is required.", + "uri": "https://aka.ms/amba/alz/docs", + "style": "Info" + } + }, + { + "name": "resourceScope", + "type": "Microsoft.Common.ResourceScope", + "kind": "ManagementGroup", + "instanceDetailsLabel": "AMBA Accelerator" + }, + { + "name": "getmanagementSubscriptionId", + "type": "Microsoft.Solutions.ArmApiControl", + "request": { + "method": "POST", + "path": "providers/Microsoft.ResourceGraph/resources?api-version=2021-03-01", + "body": { + "query": "resourcecontainers| where type == 'microsoft.resources/subscriptions'| project label=tostring(name) , description=id, value=subscriptionId | order by label asc" + } + } + }, + { + "name": "getbringYourOwnUserAssignedManagedIdentityResourceId", + "type": "Microsoft.Solutions.ArmApiControl", + "request": { + "method": "POST", + "path": "providers/Microsoft.ResourceGraph/resources?api-version=2021-03-01", + "body": { + "query": "resources | where type =~ 'Microsoft.ManagedIdentity/userAssignedIdentities'| project label=tostring(name) , description=id, value=id | order by label asc" + } + } + }, + { + "name": "ALZMonitorResourceGroupName", + "type": "Microsoft.Common.TextBox", + "label": "Resource group for baseline alerts", + "toolTip": "Resource group for activity log alerts and action groups. Will be created in all subscriptions in scope for the policy", + "visible": "[equals(steps('monitor').enableMonitorBaselines,'Yes')]", + "defaultValue": "rg-amba-monitoring-001", + "constraints": { + "required": "true", + "regex": "^[a-zA-Z0-9][a-zA-Z0-9-_.()]{0,89}[a-zA-Z0-9]$", + "validationMessage": "Please provide a valid resource group name" + } + }, + { + "name": "getLocations", + "type": "Microsoft.Solutions.ArmApiControl", + "request": { + "method": "GET", + "path": "locations?api-version=2019-11-01" + } + }, + { + "name": "ALZMonitorResourceGroupLocation", + "type": "Microsoft.Common.DropDown", + "label": "Resource group location", + "filter": true, + "toolTip": "Specify the location for said resource group", + "defaultValue": "[steps('basics').resourceScope.location.displayName]", + "constraints": { + "allowedValues": "[map(steps('basics').getLocations.value,(item) => parse(concat('{\"label\":\"',item.displayName,'\",\"value\":\"',item.name,'\"}')))]", + "required": true + }, + "visible": true + }, + { + "name": "bringYourOwnUserAssignedManagedIdentity", + "type": "Microsoft.Common.DropDown", + "label": "Bring Your Own User Assigned Managed Identity", + "subLabel": "", + "defaultValue": "No", + "toolTip": "Specify if you want to bring your own user assigned managed identity for monitoring purpose.", + "constraints": { + "required": false, + "allowedValues": [ + { + "label": "Yes", + "value": "Yes" + }, + { + "label": "No", + "value": "No" + } + ], + "validations": [] + }, + "infoMessages": [], + "visible": true + }, + { + "name": "bringYourOwnUserAssignedManagedIdentityResourceId", + "type": "Microsoft.Common.DropDown", + "label": "Bring Your Own User Assigned Managed Identity Resource Id", + "multiselect": false, + "defaultValue": "", + "filter": false, + "toolTip": "Specify the resource id of the user assigned managed identity if you want to bring your own user assigned managed identity for monitoring purpose.", + "constraints": { + "required": false, + "allowedValues": "[steps('basics').getbringYourOwnUserAssignedManagedIdentityResourceId.data]" + }, + "visible": "[equals(steps('basics').bringYourOwnUserAssignedManagedIdentity,'Yes')]" + }, + { + "name": "userAssignedManagedIdentityName", + "type": "Microsoft.Common.TextBox", + "label": "User Assigned Managed Identity Name", + "subLabel": "", + "defaultValue": "id-amba-prod-001", + "toolTip": "Specify the name of the user assigned managed identity for monitoring purpose.", + "constraints": { + "required": false, + "regex": "", + "validationMessage": "", + "validations": [] + }, + "infoMessages": [], + "visible": "[equals(steps('basics').bringYourOwnUserAssignedManagedIdentity,'No')]" + }, + { + "name": "managementSubscriptionId", + "type": "Microsoft.Common.DropDown", + "label": "Management Subscription Id", + "visible": "[equals(steps('basics').bringYourOwnUserAssignedManagedIdentity,'No')]", + "multiselect": false, + "defaultValue": "", + "filter": false, + "toolTip": "Provide the subscription id where the user assigned managed identity will be created.", + "constraints": { + "allowedValues": "[steps('basics').getmanagementSubscriptionId.data]" + } + }, + { + "name": "deployAMBAPortalAccelerator", + "type": "Microsoft.Common.TextBox", + "label": "Deploy AMBA Portal Accelerator", + "toolTip": "", + "visible": false, + "defaultValue": "Yes", + "constraints": { + "required": "true" + } + }, + { + "name": "ALZMonitorResourceGroupTags", + "type": "Microsoft.Common.TextBox", + "label": "Resource Group Tags", + "toolTip": "Provide the tags for the resource group for Azure Monitor Baseline Alerts. Tags are name/value pairs that enable you to categorize resources and view consolidated billing by applying the same tag to multiple resources and resource groups.", + "visible": true, + "placeholder": "{\"_deployed_by_amba\": \"true\"}", + "defaultValue": "", + "constraints": { + "required": false, + "regex": "", + "validationMessage": "", + "validations": [] + } + }, + { + "name": "cuaSection", + "type": "Microsoft.Common.Section", + "label": "Telemetry Tracking Using Customer Usage Attribution (PID)", + "elements": [ + { + "name": "cuaSettingsInfo", + "type": "Microsoft.Common.InfoBox", + "visible": true, + "options": { + "text": "Microsoft can identify the deployments of the Azure Resource Manager templates with the deployed Azure resources. Microsoft collects this information to provide the best experiences with their products and to operate their business. The telemetry is collected through customer usage attribution. The data is collected and governed by Microsoft's privacy policies, located at the trust center. Visit this link to find out more.", + "uri": "https://azure.github.io/azure-monitor-baseline-alerts/patterns/alz/Telemetry/", + "style": "Info" + } + }, + { + "name": "telemetryOptOut", + "type": "Microsoft.Common.OptionsGroup", + "visible": true, + "label": "Customer Usage Selection Options", + "defaultValue": "Enabled", + "constraints": { + "allowedValues": [ + { + "label": "Enabled", + "value": "No" + }, + { + "label": "Disabled", + "value": "Yes" + } + ], + "required": true + } + } + ], + "visible": true + } + ] + }, + { + "name": "Configuration", + "label": "Management Groups Settings", + "elements": [ + { + "name": "alznoalignedintro", + "type": "Microsoft.Common.InfoBox", + "visible": true, + "options": { + "text": "If you have a single management group, configure the variables Enterprise Scale Company Prefix, Identity Management Group, Management Management Group, Connectivity Management Group and Landing Zones Management Group with the same group name", + "uri": "https://azure.github.io/azure-monitor-baseline-alerts/patterns/alz/deploy/Introduction-to-deploying-the-ALZ-Pattern/", + "style": "Info" + } + }, + { + "name": "enterpriseScaleCompanyPrefix", + "type": "Microsoft.Common.DropDown", + "label": "Enterprise Scale Company Management Group", + "multiselect": false, + "defaultValue": "[steps('basics').resourceScope.managementGroup.name]", + "filter": false, + "defaultDescription": "Enterprise Scale Company Management Group", + "toolTip": "Management group where you wish to deploy the policies and the initiatives. This is usually the so called “pseudo root management group”, this would be the so called “Intermediate Root Management Group” (directly beneath the “Tenant Root Group”).", + "constraints": { + "allowedValues": "[map(steps('Configuration').ManagementGroupAPI.value, (item) => parse(concat('{\"label\":\"', item.name, '\",\"value\":\"', item.name, '\"}')))]", + "required": true + }, + "visible": true + }, + { + "name": "ManagementGroupAPI", + "type": "Microsoft.Solutions.ArmApiControl", + "request": { + "method": "GET", + "path": "providers/Microsoft.Management/managementGroups?api-version=2020-05-01" + } + }, + { + "name": "platformManagementGroup", + "type": "Microsoft.Common.DropDown", + "label": "Platform Management Group", + "multiselect": false, + "defaultValue": "", + "filter": false, + "defaultDescription": "Platform Management Group", + "toolTip": "Provide the name of the Management Group that will be used to host the platform resources.", + "constraints": { + "allowedValues": "[map(steps('Configuration').ManagementGroupAPI.value, (item) => parse(concat('{\"label\":\"', item.name, '\",\"value\":\"', item.name, '\"}')))]", + "required": false + }, + "visible": false + }, + { + "name": "enableAMBAIdentity", + "type": "Microsoft.Common.DropDown", + "label": "Enable AMBA Identity", + "defaultValue": "Yes", + "toolTip": "If 'Yes' is selected the Deploy Azure Monitor Baseline Alerts for Identity policy initiative is assigned to the Identity management group. This will ensure that relevant new resources created within that scope are configured with appropriate baseline alerts. For more details on what is included in the initiative please refer to https://aka.ms/amba/alz/wiki under Azure Policy Initiatives and Alert Details.", + "constraints": { + "required": true, + "allowedValues": [ + { + "label": "Yes", + "value": "Yes" + }, + { + "label": "No", + "value": "No" + } + ] + }, + "visible": true + }, + { + "name": "IdentityManagementGroup", + "type": "Microsoft.Common.DropDown", + "label": "Identity Management Group", + "multiselect": false, + "defaultValue": "", + "filter": false, + "toolTip": "Provide the name of the Management Group that will be used to host the identity resources.", + "constraints": { + "allowedValues": "[map(steps('Configuration').ManagementGroupAPI.value, (item) => parse(concat('{\"label\":\"', item.name, '\",\"value\":\"', item.name, '\"}')))]", + "required": true + }, + "visible": "[equals(steps('Configuration').enableAMBAIdentity,'Yes')]" + }, + { + "name": "enableAMBAManagement", + "type": "Microsoft.Common.DropDown", + "label": "Enable AMBA Management", + "defaultValue": "Yes", + "toolTip": "If 'Yes' is selected the Deploy Azure Monitor Baseline Alerts for Management policy initiative is assigned to the Management management group. This will ensure that relevant new resources created within that scope are configured with appropriate baseline alerts. For more details on what is included in the initiative please refer to https://aka.ms/amba/alz/wiki under Azure Policy Initiatives and Alert Details.", + "constraints": { + "required": true, + "allowedValues": [ + { + "label": "Yes", + "value": "Yes" + }, + { + "label": "No", + "value": "No" + } + ] + }, + "visible": true + }, + { + "name": "managementManagementGroup", + "type": "Microsoft.Common.DropDown", + "label": "Management Management Group", + "multiselect": false, + "defaultValue": "", + "filter": false, + "toolTip": "Provide the name of the Management Group that will be used to host the management resources.", + "constraints": { + "allowedValues": "[map(steps('Configuration').ManagementGroupAPI.value, (item) => parse(concat('{\"label\":\"', item.name, '\",\"value\":\"', item.name, '\"}')))]", + "required": true + }, + "visible": "[equals(steps('Configuration').enableAMBAManagement,'Yes')]" + }, + { + "name": "enableAMBAConnectivity", + "type": "Microsoft.Common.DropDown", + "label": "Enable AMBA Connectivity", + "defaultValue": "Yes", + "toolTip": "If 'Yes' is selected the Deploy Azure Monitor Baseline Alerts for Connectivity policy initiative is assigned to the Connectivity management group. This will ensure that relevant new resources created within that scope are configured with appropriate baseline alerts. For more details on what is included in the initiative please refer to https://aka.ms/amba/alz/wiki under Azure Policy Initiatives and Alert Details.", + "constraints": { + "required": true, + "allowedValues": [ + { + "label": "Yes", + "value": "Yes" + }, + { + "label": "No", + "value": "No" + } + ] + }, + "visible": true + }, + { + "name": "connectivityManagementGroup", + "type": "Microsoft.Common.DropDown", + "label": "Connectivity Management Group", + "multiselect": false, + "defaultValue": "", + "filter": false, + "toolTip": "Provide the name of the Management Group that will be used to host the connectivity resources.", + "constraints": { + "allowedValues": "[map(steps('Configuration').ManagementGroupAPI.value, (item) => parse(concat('{\"label\":\"', item.name, '\",\"value\":\"', item.name, '\"}')))]", + "required": true + }, + "visible": "[equals(steps('Configuration').enableAMBAConnectivity,'Yes')]" + }, + { + "name": "enableAMBAHybridVM", + "type": "Microsoft.Common.DropDown", + "label": "Enable AMBA Hybrid VM", + "subLabel": "", + "defaultValue": "Yes", + "toolTip": "This initiative deploys Azure Monitor Baseline Alerts to monitor Azure Arc-enabled Servers", + "constraints": { + "required": true, + "allowedValues": [ + { + "label": "Yes", + "value": "Yes" + }, + { + "label": "No", + "value": "No" + } + ], + "validations": [] + }, + "infoMessages": [], + "visible": true + }, + { + "name": "enableAMBAKeyManagement", + "type": "Microsoft.Common.DropDown", + "label": "Enable AMBA Key Management", + "subLabel": "", + "defaultValue": "Yes", + "toolTip": "This initiative deploys Azure Monitor Baseline Alerts to monitor Key Management Services such as Azure Key Vault, and Managed HSM.", + "constraints": { + "required": true, + "allowedValues": [ + { + "label": "Yes", + "value": "Yes" + }, + { + "label": "No", + "value": "No" + } + ], + "validations": [] + }, + "infoMessages": [], + "visible": true + }, + { + "name": "enableAMBALoadBalancing", + "type": "Microsoft.Common.DropDown", + "label": "Enable AMBA Load Balancing", + "subLabel": "", + "defaultValue": "Yes", + "toolTip": "This initiative deploys Azure Monitor Baseline Alerts to monitor Load Balancing Services such as Load Balancer, Application Gateway, Traffic Manager, and Azure Front Door.", + "constraints": { + "required": true, + "allowedValues": [ + { + "label": "Yes", + "value": "Yes" + }, + { + "label": "No", + "value": "No" + } + ], + "validations": [] + }, + "infoMessages": [], + "visible": true + }, + { + "name": "enableAMBANetworkChanges", + "type": "Microsoft.Common.DropDown", + "label": "Enable AMBA Network Changes", + "subLabel": "", + "defaultValue": "Yes", + "toolTip": "This initiative implements Azure Monitor Baseline Alerts to monitor alterations in Network Routing and Security, such as modifications to Route Tables and the removal of Network Security Groups.", + "constraints": { + "required": true, + "allowedValues": [ + { + "label": "Yes", + "value": "Yes" + }, + { + "label": "No", + "value": "No" + } + ], + "validations": [] + }, + "infoMessages": [], + "visible": true + }, + { + "name": "enableAMBARecoveryServices", + "type": "Microsoft.Common.DropDown", + "label": "Enable AMBA Recovery Services", + "subLabel": "", + "defaultValue": "Yes", + "toolTip": "This initiative deploys Azure Monitor Baseline Alerts to monitor Recovery Services such as Azure Backup, and Azure Site Recovery.", + "constraints": { + "required": true, + "allowedValues": [ + { + "label": "Yes", + "value": "Yes" + }, + { + "label": "No", + "value": "No" + } + ], + "validations": [] + }, + "infoMessages": [], + "visible": true + }, + { + "name": "enableAMBAStorage", + "type": "Microsoft.Common.DropDown", + "label": "Enable AMBA Storage", + "subLabel": "", + "defaultValue": "Yes", + "toolTip": "This initiative deploys Azure Monitor Baseline Alerts to monitor Storage Services such as Storage accounts.", + "constraints": { + "required": true, + "allowedValues": [ + { + "label": "Yes", + "value": "Yes" + }, + { + "label": "No", + "value": "No" + } + ], + "validations": [] + }, + "infoMessages": [], + "visible": true + }, + { + "name": "enableAMBAVM", + "type": "Microsoft.Common.DropDown", + "label": "Enable AMBA VM", + "subLabel": "", + "defaultValue": "Yes", + "toolTip": "This initiative deploys Azure Monitor Baseline Alerts to monitor Azure Virtual Machines.", + "constraints": { + "required": true, + "allowedValues": [ + { + "label": "Yes", + "value": "Yes" + }, + { + "label": "No", + "value": "No" + } + ], + "validations": [] + }, + "infoMessages": [], + "visible": true + }, + { + "name": "enableAMBAWeb", + "type": "Microsoft.Common.DropDown", + "label": "Enable AMBA Web", + "subLabel": "", + "defaultValue": "Yes", + "toolTip": "This initiative deploys Azure Monitor Baseline Alerts to monitor Web Services such as App Services.", + "constraints": { + "required": true, + "allowedValues": [ + { + "label": "Yes", + "value": "Yes" + }, + { + "label": "No", + "value": "No" + } + ], + "validations": [] + }, + "infoMessages": [], + "visible": true + }, + { + "name": "LandingZoneManagementGroup", + "type": "Microsoft.Common.DropDown", + "label": "Landing Zone Management Group", + "multiselect": false, + "defaultValue": "", + "filter": false, + "toolTip": "Provide the name of the Management Group that will be used to host the landing zone resources.", + "constraints": { + "allowedValues": "[map(steps('Configuration').ManagementGroupAPI.value, (item) => parse(concat('{\"label\":\"', item.name, '\",\"value\":\"', item.name, '\"}')))]", + "required": true + }, + "visible": "[or(equals(steps('Configuration').enableAMBAHybridVM,'Yes'), equals(steps('Configuration').enableAMBAKeyManagement,'Yes'), equals(steps('Configuration').enableAMBALoadBalancing,'Yes'), equals(steps('Configuration').enableAMBANetworkChanges,'Yes'), equals(steps('Configuration').enableAMBARecoveryServices,'Yes'), equals(steps('Configuration').enableAMBAStorage,'Yes'), equals(steps('Configuration').enableAMBAVM,'Yes'), equals(steps('Configuration').enableAMBAWeb,'Yes'))]" + }, + { + "name": "enableAMBAServiceHealth", + "type": "Microsoft.Common.DropDown", + "label": "Enable AMBA Service Health", + "defaultValue": "Yes", + "toolTip": "Assign Service health initiative", + "constraints": { + "required": true, + "allowedValues": [ + { + "label": "Yes", + "value": "Yes" + }, + { + "label": "No", + "value": "No" + } + ] + }, + "visible": true + }, + { + "name": "enableAMBANotificationAssets", + "type": "Microsoft.Common.DropDown", + "label": "Enable AMBA Notification Assets", + "defaultValue": "Yes", + "toolTip": "Assign Action assets initiative", + "constraints": { + "required": true, + "allowedValues": [ + { + "label": "Yes", + "value": "Yes" + }, + { + "label": "No", + "value": "No" + } + ] + }, + "visible": true + } + ] + }, + { + "name": "Notification", + "label": "Notification Settings", + "elements": [ + { + "name": "Notificationintro", + "type": "Microsoft.Common.InfoBox", + "visible": true, + "options": { + "text": "The Bring Your Own Notifications (BYON) feature allows brownfield customers to use their existing Action Groups (also known as AGs) and Alert Processing Rule (also known as APR) not forcing the use of notification assets deployed by both the Notification Assets initiative and the Deploy Service Health Action Group policy definition present in the ALZ pattern. It also allows Brownfield customer who deployed the ALZ pattern when this feature wasn’t available, to switch to it. The BYON feature works by setting the necessary parameter values before running the ALZ pattern deployment. Customers have the choice to either specify one or more existing AGs and one APR or to enter target values so the AG and the APR will be created using the actions specified in the parameter file (including the option to not specify any value and creating an empty AG).", + "uri": "https://azure.github.io/azure-monitor-baseline-alerts/patterns/alz/Bring-your-own-Notifications/", + "style": "Info" + } + }, + { + "name": "NotificationOption", + "type": "Microsoft.Common.OptionsGroup", + "label": "Bring Your Own Notifications (BYON)", + "defaultValue": "No", + "toolTip": "The BYON feature works by setting the necessary parameter values before running the ALZ pattern deployment. Customers have the choice to either specify one or more existing AGs and one APR or to enter target values so the AG and the APR will be created using the actions specified in the parameter file (including the option to not specify any value and creating an empty AG).", + "constraints": { + "allowedValues": [ + { + "label": "Yes", + "value": "Yes" + }, + { + "label": "No", + "value": "No" + } + ] + }, + "visible": true + }, + { + "name": "GETBYOActionGroup", + "type": "Microsoft.Solutions.ArmApiControl", + "request": { + "method": "POST", + "path": "providers/Microsoft.ResourceGraph/resources?api-version=2021-03-01", + "body": { + "query": "resources | where type == 'microsoft.insights/actiongroups'| project label=tostring(name) , description=name, value=id | order by label asc" + } + } + }, + { + "name": "BYOActionGroup", + "type": "Microsoft.Common.DropDown", + "label": "Action Group", + "multiselect": true, + "defaultValue": "", + "filter": true, + "toolTip": "The action groups to be used as action for the alerts (including Service Health alerts).", + "constraints": { + "allowedValues": "[steps('Notification').GETBYOActionGroup.data]", + "required": false + }, + "visible": "[equals(steps('Notification').NotificationOption,'Yes')]" + }, + { + "name": "BYOAlertProcessingRule", + "type": "Microsoft.Solutions.ResourceSelector", + "label": "Alert Processing Rule", + "toolTip": "The alert processing rule to be used as action for the alerts (including Service Health alerts).", + "resourceType": "Microsoft.AlertsManagement/actionRules", + "visible": "[equals(steps('Notification').NotificationOption,'Yes')]" + }, + { + "name": "ALZMonitorActionGroupEmail", + "type": "Microsoft.Common.TextBox", + "label": "Email contact for action group notifications", + "toolTip": "Provide the email address(es) for the action group used for monitoring.", + "visible": "[equals(steps('Notification').NotificationOption,'No')]", + "placeholder": "[\"example1@contoso.com\",\"example2@contoso.com\"]", + "defaultValue": "", + "constraints": { + "required": false, + "regex": "", + "validationMessage": "", + "validations": [] + } + }, + { + "name": "ALZWebhookServiceUri", + "type": "Microsoft.Common.TextBox", + "label": "Webhook Service Uri", + "toolTip": "The URI(s) to be used as action for the alerts (including Service Health alerts). Leave the value blank if no Webhook is used.", + "visible": "[equals(steps('Notification').NotificationOption,'No')]", + "placeholder": "[\"http://example.com/\"]", + "defaultValue": "", + "constraints": { + "required": false, + "regex": "", + "validationMessage": "", + "validations": [] + } + }, + { + "name": "getALZArmRoleId", + "type": "Microsoft.Solutions.ArmApiControl", + "request": { + "method": "POST", + "path": "providers/Microsoft.ResourceGraph/resources?api-version=2021-03-01", + "body": { + "query": "authorizationresources |extend roleName = tostring(properties.roleName)|where roleName in~ ('Owner', 'Contributor', 'Reader', 'Monitoring Contributor', 'Monitoring Reader')|project label=tostring(roleName) , description=roleName, value=name | order by label asc" + } + } + }, + { + "name": "ALZArmRoleId", + "type": "Microsoft.Common.DropDown", + "label": "Arm Role Id", + "multiselect": true, + "filter": true, + "toolTip": "The Azure Resource Manager Role(s) where notifications of the alerts (including Service Health alerts) are sent to. Leave the value blank if no Azure Resource Manager Role notification is require", + "visible": "[equals(steps('Notification').NotificationOption,'No')]", + "defaultValue": "", + "constraints": { + "allowedValues": "[steps('Notification').getALZArmRoleId.data]", + "required": false + } + }, + { + "name": "LogicAppOption", + "type": "Microsoft.Common.OptionsGroup", + "label": "Add Logic App as action", + "defaultValue": "No", + "toolTip": "Select 'Yes' if you want to use a Logic App as action for the alerts.", + "constraints": { + "allowedValues": [ + { + "label": "Yes", + "value": "Yes" + }, + { + "label": "No", + "value": "No" + } + ] + }, + "visible": "[equals(steps('Notification').NotificationOption,'No')]" + }, + { + "name": "getLogicAppId", + "type": "Microsoft.Solutions.ArmApiControl", + "request": { + "method": "POST", + "path": "providers/Microsoft.ResourceGraph/resources?api-version=2021-03-01", + "body": { + "query": "resources | where type =~ 'microsoft.logic/workflows' or (type =~ 'Microsoft.Web/sites' and kind =~ 'functionapp,workflowapp') | project label=tostring(name), description=id, value=id | order by label asc" + } + } + }, + { + "name": "getALZLogicappCallbackUrl", + "type": "Microsoft.Solutions.ArmApiControl", + "request": { + "method": "POST", + "path": "providers/Microsoft.ResourceGraph/resources?api-version=2021-03-01", + "body": { + "query": "resources| where type == 'microsoft.logic/workflows'| project label=tostring(properties.accessEndpoint) , description=properties.accessEndpoint, value=properties.accessEndpoint | order by label asc" + } + } + }, + { + "name": "getALZEventHubResourceId", + "type": "Microsoft.Solutions.ArmApiControl", + "request": { + "method": "POST", + "path": "providers/Microsoft.ResourceGraph/resources?api-version=2021-03-01", + "body": { + "query": "resources| where type == 'microsoft.eventhub/namespaces'| project label=tostring(name) , description=id, value=id | order by label asc" + } + } + }, + { + "name": "ALZLogicappResourceId", + "type": "Microsoft.Common.DropDown", + "label": "Logicapp Resource Id", + "toolTip": "The Logic app resource id to be used as action for the alerts (including Service Health alerts). Leave the value blank if no Logic app is used", + "visible": "[equals(steps('Notification').LogicAppOption,'Yes')]", + "multiselect": false, + "defaultValue": "", + "filter": false, + "constraints": { + "allowedValues": "[steps('Notification').getLogicAppId.data]", + "required": false + } + }, + { + "name": "ALZLogicappCallbackUrl", + "type": "Microsoft.Common.TextBox", + "label": "Logicapp Callback Url", + "toolTip": "The Logic app callback url of the Logic app you want to use as action for the alerts (including Service Health alerts). Leave the value blank if no Logic app is used. To retrieve the callback url you can either use the Get-AzLogicAppTriggerCallbackUrl PowerShell command or navigate to the Logic app in the Azure portal, go to Logic app designer, expand the trigger activity (When an HTTP request is received) and copy the value in the URL field using the 2-sheets icon.", + "visible": "[equals(steps('Notification').LogicAppOption,'Yes')]", + "defaultValue": "", + "constraints": { + "required": false, + "regex": "", + "validationMessage": "" + } + }, + { + "name": "EventHubOption", + "type": "Microsoft.Common.OptionsGroup", + "label": "Add Event Hub as action", + "defaultValue": "No", + "toolTip": "Select 'Yes' if you want to use an Event Hub as action for the alerts.", + "constraints": { + "allowedValues": [ + { + "label": "Yes", + "value": "Yes" + }, + { + "label": "No", + "value": "No" + } + ] + }, + "visible": "[equals(steps('Notification').NotificationOption,'No')]" + }, + { + "name": "ALZEventHubResourceId", + "type": "Microsoft.Common.DropDown", + "label": "Event Hub Resource Id", + "toolTip": "The Event Hubs to be used as action for the alerts (including Service Health alerts). Leave the value blank if no Event Hubs is used.", + "visible": "[equals(steps('Notification').EventHubOption,'Yes')]", + "multiselect": true, + "defaultValue": "", + "filter": false, + "constraints": { + "allowedValues": "[steps('Notification').getALZEventHubResourceId.data]", + "required": false + } + }, + { + "name": "AzureFunctionOption", + "type": "Microsoft.Common.OptionsGroup", + "label": "Add Azure Function as action", + "defaultValue": "No", + "toolTip": "Select 'Yes' if you want to use an Azure Function as action for the alerts.", + "constraints": { + "allowedValues": [ + { + "label": "Yes", + "value": "Yes" + }, + { + "label": "No", + "value": "No" + } + ] + }, + "visible": "[equals(steps('Notification').NotificationOption,'No')]" + }, + { + "name": "ALZFunctionResourceId", + "type": "Microsoft.Common.TextBox", + "label": "Function Resource Id", + "toolTip": "The Function resource id to be used as action for the alerts (including Service Health alerts). Leave the value blank if no Function is used.", + "visible": "[equals(steps('Notification').AzureFunctionOption,'Yes')]", + "defaultValue": "", + "constraints": { + "required": false, + "regex": "", + "validationMessage": "" + } + }, + { + "name": "ALZFunctionTriggerUrl", + "type": "Microsoft.Common.TextBox", + "label": "Function Trigger Url", + "toolTip": "Function App trigger url of the function to be used as action for the alerts (including Service Health alerts). Leave the value blank if no Function is used. To retrieve the Function App trigger url with the corresponding code, navigate to the HTTP-triggered functions in the Azure portal, go to Code and Test, select Get function URL from the menu top menu and copy the value in the URL field using the 2-sheets icon.", + "visible": "[equals(steps('Notification').AzureFunctionOption,'Yes')]", + "defaultValue": "", + "constraints": { + "required": false, + "regex": "", + "validationMessage": "" + } + } + ] + } + ] + }, + "outputs": { + "kind": "ManagementGroup", + "location": "[steps('basics').resourceScope.location.name]", + "managementGroupId": "[steps('basics').resourceScope.managementGroup.id]", + "parameters": { + "location": "[steps('basics').resourceScope.location.name]", + "ManagementGroupId": "[steps('basics').resourceScope.managementGroup.name]", + "ALZMonitorResourceGroupName": "[steps('basics').ALZMonitorResourceGroupName]", + "ALZMonitorActionGroupEmail": "[steps('Notification').ALZMonitorActionGroupEmail]", + "ALZMonitorResourceGroupLocation": "[steps('basics').ALZMonitorResourceGroupLocation]", + "ALZMonitorResourceGroupTags": "[steps('basics').ALZMonitorResourceGroupTags]", + "ALZLogicappResourceId": "[steps('Notification').ALZLogicappResourceId]", + "ALZLogicappCallbackUrl": "[steps('Notification').ALZLogicappCallbackUrl]", + "bringYourOwnUserAssignedManagedIdentity": "[steps('basics').bringYourOwnUserAssignedManagedIdentity]", + "bringYourOwnUserAssignedManagedIdentityResourceId": "[steps('basics').bringYourOwnUserAssignedManagedIdentityResourceId]", + "userAssignedManagedIdentityName": "[steps('basics').userAssignedManagedIdentityName]", + "managementSubscriptionId": "[steps('basics').managementSubscriptionId]", + "ALZArmRoleId": "[steps('Notification').ALZArmRoleId]", + "ALZEventHubResourceId": "[steps('Notification').ALZEventHubResourceId]", + "ALZWebhookServiceUri": "[steps('Notification').ALZWebhookServiceUri]", + "ALZFunctionResourceId": "[steps('Notification').ALZFunctionResourceId]", + "ALZFunctionTriggerUrl": "[steps('Notification').ALZFunctionTriggerUrl]", + "enableAMBAManagement": "[steps('Configuration').enableAMBAManagement]", + "enableAMBAServiceHealth": "[steps('Configuration').enableAMBAServiceHealth]", + "enableAMBANotificationAssets": "[steps('Configuration').enableAMBANotificationAssets]", + "enableAMBAConnectivity": "[steps('Configuration').enableAMBAConnectivity]", + "enableAMBAIdentity": "[steps('Configuration').enableAMBAIdentity]", + "enableAMBAHybridVM": "[steps('Configuration').enableAMBAHybridVM]", + "enterpriseScaleCompanyPrefix": "[steps('Configuration').enterpriseScaleCompanyPrefix]", + "platformManagementGroup": "['contoso-platform']", + "IdentityManagementGroup": "[if(equals(steps('Configuration').enableAMBAIdentity,'No'), 'contoso-identity', steps('Configuration').IdentityManagementGroup)]", + "managementManagementGroup": "[if(equals(steps('Configuration').enableAMBAManagement, 'No'), 'contoso-management', steps('Configuration').managementManagementGroup)]", + "connectivityManagementGroup": "[if(equals(steps('Configuration').enableAMBAConnectivity, 'No'), 'contoso-connectivity', steps('Configuration').connectivityManagementGroup)]", + "LandingZoneManagementGroup": "[if(empty(steps('Configuration').LandingZoneManagementGroup), 'contoso-landingzones', steps('Configuration').LandingZoneManagementGroup)]", + "BYOActionGroup": "[steps('Notification').BYOActionGroup]", + "BYOAlertProcessingRule": "[steps('Notification').BYOAlertProcessingRule.id]", + "deployAMBAPortalAccelerator": "Yes", + "telemetryOptOut": "[steps('basics').cuaSection.telemetryOptOut]", + "enableAMBAKeyManagement": "[steps('Configuration').enableAMBAKeyManagement]", + "enableAMBALoadBalancing": "[steps('Configuration').enableAMBALoadBalancing]", + "enableAMBANetworkChanges": "[steps('Configuration').enableAMBANetworkChanges]", + "enableAMBARecoveryServices": "[steps('Configuration').enableAMBARecoveryServices]", + "enableAMBAStorage": "[steps('Configuration').enableAMBAStorage]", + "enableAMBAVM": "[steps('Configuration').enableAMBAVM]", + "enableAMBAWeb": "[steps('Configuration').enableAMBAWeb]" + } + } + } +} diff --git a/patterns/alz/alzArm.json b/patterns/alz/alzArm.json index 917f9ebaa..73e4fcbb1 100644 --- a/patterns/alz/alzArm.json +++ b/patterns/alz/alzArm.json @@ -1,6 +1,7 @@ { "$schema": "https://schema.management.azure.com/schemas/2019-08-01/managementGroupDeploymentTemplate.json#", "contentVersion": "1.0.0.0", + // MARK: Parameters "parameters": { "enterpriseScaleCompanyPrefix": { "type": "string", @@ -16,6 +17,7 @@ "No" ], "metadata": { + "displayName": "Teletry Opt Out", "description": "The customer usage identifier used for telemetry purposes. The default value of False enables telemetry. The value of True disables telemetry." } }, @@ -71,7 +73,7 @@ "description": "Assign Identity initiative" } }, - "enableAMBALandingZone": { + "enableAMBAManagement": { "type": "string", "defaultValue": "Yes", "allowedValues": [ @@ -79,10 +81,10 @@ "No" ], "metadata": { - "description": "Assign Landing zone initiative" + "description": "Assign Management initiative" } }, - "enableAMBAManagement": { + "enableAMBAServiceHealth": { "type": "string", "defaultValue": "Yes", "allowedValues": [ @@ -90,10 +92,10 @@ "No" ], "metadata": { - "description": "Assign Management initiative" + "description": "Assign Service health initiative" } }, - "enableAMBAServiceHealth": { + "enableAMBANotificationAssets": { "type": "string", "defaultValue": "Yes", "allowedValues": [ @@ -101,10 +103,10 @@ "No" ], "metadata": { - "description": "Assign Service health initiative" + "description": "Assign Action assets initiative" } }, - "enableAMBANotificationAssets": { + "enableAMBAHybridVM": { "type": "string", "defaultValue": "Yes", "allowedValues": [ @@ -112,10 +114,10 @@ "No" ], "metadata": { - "description": "Assign Action assets initiative" + "description": "Assign HybridVM initiative" } }, - "enableAMBAHybridVM": { + "enableAMBAKeyManagement": { "type": "string", "defaultValue": "Yes", "allowedValues": [ @@ -123,7 +125,73 @@ "No" ], "metadata": { - "description": "Assign HybridVM initiative" + "description": "Assign Key Management initiative" + } + }, + "enableAMBALoadBalancing": { + "type": "string", + "defaultValue": "Yes", + "allowedValues": [ + "Yes", + "No" + ], + "metadata": { + "description": "Assign Load Balancing initiative" + } + }, + "enableAMBANetworkChanges": { + "type": "string", + "defaultValue": "Yes", + "allowedValues": [ + "Yes", + "No" + ], + "metadata": { + "description": "Assign Network Changes initiative" + } + }, + "enableAMBARecoveryServices": { + "type": "string", + "defaultValue": "Yes", + "allowedValues": [ + "Yes", + "No" + ], + "metadata": { + "description": "Assign Recovery Services initiative" + } + }, + "enableAMBAStorage": { + "type": "string", + "defaultValue": "Yes", + "allowedValues": [ + "Yes", + "No" + ], + "metadata": { + "description": "Assign Storage initiative" + } + }, + "enableAMBAVM": { + "type": "string", + "defaultValue": "Yes", + "allowedValues": [ + "Yes", + "No" + ], + "metadata": { + "description": "Assign VM initiative" + } + }, + "enableAMBAWeb": { + "type": "string", + "defaultValue": "Yes", + "allowedValues": [ + "Yes", + "No" + ], + "metadata": { + "description": "Assign Web initiative" } }, "bringYourOwnUserAssignedManagedIdentity": { @@ -180,62 +248,93 @@ "description": "Provide the tags for the resource group for Azure Monitor Baseline Alerts." } }, + "ALZMonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "Effect", + "description": "Tag name to disable monitoring on resource. Set to true if monitoring should be disabled" + }, + "defaultValue": "MonitorDisable" + }, + "ALZMonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] + }, "ALZMonitorActionGroupEmail": { - "type": "string", + "type": "Array", + "defaultValue": [], "metadata": { - "description": "Provide the email address for the action group used for monitoring." + "description": "Provide the email address(es) for the action group used for monitoring." } }, "ALZLogicappResourceId": { "type": "string", + "defaultValue": "", "metadata": { "description": "Provide the resource id of the logic app used for monitoring." } }, "ALZLogicappCallbackUrl": { "type": "string", + "defaultValue": "", "metadata": { "description": "Provide the callback url of the logic app used for monitoring." } }, "ALZArmRoleId": { - "type": "string", + "type": "array", + "defaultValue": [], "metadata": { "description": "Provide the role id used for monitoring." } }, "ALZEventHubResourceId": { - "type": "string", + "type": "array", + "defaultValue": [], "metadata": { "description": "Provide the resource id of the event hub used for monitoring." } }, "ALZWebhookServiceUri": { - "type": "string", + "type": "Array", + "defaultValue": [], "metadata": { - "description": "Provide the service uri of the webhook used for monitoring." + "description": "Provide the service uri(s) of the webhook used for monitoring." } }, "ALZFunctionResourceId": { "type": "string", + "defaultValue": "", "metadata": { "description": "Provide the resource id of the function used for monitoring." } }, "ALZFunctionTriggerUrl": { "type": "string", + "defaultValue": "", "metadata": { "description": "Provide the trigger url of the function used for monitoring." } }, "BYOActionGroup": { - "type": "string", + "type": "array", + "defaultValue": [], "metadata": { "description": "Provide the action group used for monitoring." } }, "BYOAlertProcessingRule": { "type": "string", + "defaultValue": "", "metadata": { "description": "Provide the alert processing rule used for monitoring." } @@ -264,10 +363,6 @@ "type": "object", "defaultValue": {} }, - "policyAssignmentParametersLandingZone": { - "type": "object", - "defaultValue": {} - }, "policyAssignmentParametersHybridVM": { "type": "object", "defaultValue": {} @@ -279,8 +374,59 @@ "policyAssignmentParametersServiceHealth": { "type": "object", "defaultValue": {} + }, + "policyAssignmentParametersKeyManagement": { + "type": "object", + "defaultValue": {} + }, + "policyAssignmentParametersLoadBalancing": { + "type": "object", + "defaultValue": {} + }, + "policyAssignmentParametersNetworkChanges": { + "type": "object", + "defaultValue": {} + }, + "policyAssignmentParametersRecoveryServices": { + "type": "object", + "defaultValue": {} + }, + "policyAssignmentParametersStorage": { + "type": "object", + "defaultValue": {} + }, + "policyAssignmentParametersVM": { + "type": "object", + "defaultValue": {} + }, + "policyAssignmentParametersWeb": { + "type": "object", + "defaultValue": {} + }, + "deployAMBAPortalAccelerator": { + "type": "string", + "defaultValue": "No", + "allowedValues": [ + "Yes", + "No" + ], + "metadata": { + "description": "Microsoft can identify the deployments of the Azure Resource Manager templates with the deployed Azure resources. Microsoft collects this information to provide the best experiences with their products and to operate their business. The telemetry is collected through customer usage attribution. The data is collected and governed by Microsoft's privacy policies, located at the trust center. Visit this link to find out more." + } + }, + "deployALZPortalAccelerator": { + "type": "string", + "defaultValue": "No", + "allowedValues": [ + "Yes", + "No" + ], + "metadata": { + "description": "Microsoft can identify the deployments of the Azure Resource Manager templates with the deployed Azure resources. Microsoft collects this information to provide the best experiences with their products and to operate their business. The telemetry is collected through customer usage attribution. The data is collected and governed by Microsoft's privacy policies, located at the trust center. Visit this link to find out more." + } } }, + // MARK: Variables "variables": { "uamiParameters": { "ALZUserAssignedManagedIdentityName": { @@ -302,6 +448,20 @@ }, "ALZMonitorResourceGroupLocation": { "value": "[parameters('ALZMonitorResourceGroupLocation')]" + }, + "ALZMonitorDisableTagName": { + "value": "[parameters('ALZMonitorDisableTagName')]" + }, + "ALZMonitorDisableTagValues": { + "value": "[parameters('ALZMonitorDisableTagValues')]" + } + }, + "policyAssignmentParametersMonitorDisable": { + "ALZMonitorDisableTagName": { + "value": "[parameters('ALZMonitorDisableTagName')]" + }, + "ALZMonitorDisableTagValues": { + "value": "[parameters('ALZMonitorDisableTagValues')]" } }, "notificationAssetParameters": { @@ -339,57 +499,112 @@ // Declaring the policy assignment parameters that will be used for all policy assignments "policyAssignmentParametersConnectivity": "[union(variables('policyAssignmentParametersCommon'), parameters('policyAssignmentParametersConnectivity'))]", "policyAssignmentParametersIdentity": "[union(variables('policyAssignmentParametersCommon'), parameters('policyAssignmentParametersIdentity'))]", - "policyAssignmentParametersLandingZone": "[union(variables('policyAssignmentParametersCommon'), parameters('policyAssignmentParametersLandingZone'))]", - "policyAssignmentParametersManagement": "[union(variables('policyAssignmentParametersCommon'), parameters('policyAssignmentParametersManagement'))]", + "policyAssignmentParametersManagement": "[union(variables('policyAssignmentParametersCommon'), parameters('policyAssignmentParametersManagement'), variables('uamiParameters'))]", "policyAssignmentParametersServiceHealth": "[union(variables('policyAssignmentParametersCommon'), parameters('policyAssignmentParametersServiceHealth'), variables('notificationAssetParameters'))]", "policyAssignmentParametersNotificationAssets": "[union(variables('policyAssignmentParametersCommon'), variables('notificationAssetParameters'))]", "policyAssignmentParametersHybridVM": "[union(variables('policyAssignmentParametersCommon'), parameters('policyAssignmentParametersHybridVM'), variables('uamiParameters'))]", + "policyAssignmentParametersKeyManagement": "[union(variables('policyAssignmentParametersCommon'), parameters('policyAssignmentParametersKeyManagement'))]", + "policyAssignmentParametersLoadBalancing": "[union(variables('policyAssignmentParametersMonitorDisable'), parameters('policyAssignmentParametersLoadBalancing'))]", + "policyAssignmentParametersNetworkChanges": "[union(variables('policyAssignmentParametersCommon'), parameters('policyAssignmentParametersNetworkChanges'))]", + "policyAssignmentParametersRecoveryServices": "[union(variables('policyAssignmentParametersMonitorDisable'), parameters('policyAssignmentParametersRecoveryServices'))]", + "policyAssignmentParametersStorage": "[union(variables('policyAssignmentParametersCommon'), parameters('policyAssignmentParametersStorage'))]", + "policyAssignmentParametersVM": "[union(variables('policyAssignmentParametersCommon'), parameters('policyAssignmentParametersVM'),variables('uamiParameters'))]", + "policyAssignmentParametersWeb": "[union(variables('policyAssignmentParametersMonitorDisable'), parameters('policyAssignmentParametersWeb'))]", // Declaring all required deployment uri's used for deployments of composite ARM templates for ESLZ "deploymentUris": { - "policyDefinitionsAMBA": "[uri(deployment().properties.templateLink.uri, 'policyDefinitions/policies.json')]", + "policyDefinitionsAutomation": "[uri(deployment().properties.templateLink.uri, 'policyDefinitions/policies-Automation.json')]", + "policyDefinitionsCompute": "[uri(deployment().properties.templateLink.uri, 'policyDefinitions/policies-Compute.json')]", + "policyDefinitionsHybrid": "[uri(deployment().properties.templateLink.uri, 'policyDefinitions/policies-Hybrid.json')]", + "policyDefinitionsKeyManagement": "[uri(deployment().properties.templateLink.uri, 'policyDefinitions/policies-KeyManagement.json')]", + "policyDefinitionsMonitoring": "[uri(deployment().properties.templateLink.uri, 'policyDefinitions/policies-Monitoring.json')]", + "policyDefinitionsNetwork": "[uri(deployment().properties.templateLink.uri, 'policyDefinitions/policies-Network.json')]", + "policyDefinitionsNotificationAssets": "[uri(deployment().properties.templateLink.uri, 'policyDefinitions/policies-NotificationAssets.json')]", + "policyDefinitionsRecoveryServices": "[uri(deployment().properties.templateLink.uri, 'policyDefinitions/policies-RecoveryServices.json')]", + "policyDefinitionsServiceHealth": "[uri(deployment().properties.templateLink.uri, 'policyDefinitions/policies-ServiceHealth.json')]", + "policyDefinitionsStorage": "[uri(deployment().properties.templateLink.uri, 'policyDefinitions/policies-Storage.json')]", + "policyDefinitionsWeb": "[uri(deployment().properties.templateLink.uri, 'policyDefinitions/policies-Web.json')]", + "policySetDefinitions": "[uri(deployment().properties.templateLink.uri, 'policyDefinitions/policySets.json')]", "AMBAConnectivityInitiative": "[uri(deployment().properties.templateLink.uri, 'policyAssignments/DINE-ConnectivityAssignment.json')]", "AMBAIdentityInitiative": "[uri(deployment().properties.templateLink.uri, 'policyAssignments/DINE-IdentityAssignment.json')]", - "AMBALandingZoneInitiative": "[uri(deployment().properties.templateLink.uri, 'policyAssignments/DINE-LandingZoneAssignment.json')]", "AMBAManagementInitiative": "[uri(deployment().properties.templateLink.uri, 'policyAssignments/DINE-ManagementAssignment.json')]", "AMBAServiceHealthInitiative": "[uri(deployment().properties.templateLink.uri, 'policyAssignments/DINE-ServiceHealthAssignment.json')]", "AMBANotificationAssetsInitiative": "[uri(deployment().properties.templateLink.uri, 'policyAssignments/DINE-NotificationAssetsAssignment.json')]", "AMBAUamiResourceGroup": "[uri(deployment().properties.templateLink.uri, 'templates/resourceGroup.json')]", "AMBAUserAssignedManagedIdentity": "[uri(deployment().properties.templateLink.uri, 'templates/userAssignedManagedIdentity.json')]", - "AMBAHybridVMInitiative": "[uri(deployment().properties.templateLink.uri, 'policyAssignments/DINE-HybridVMAssignment.json')]" + "AMBAHybridVMInitiative": "[uri(deployment().properties.templateLink.uri, 'policyAssignments/DINE-HybridVMAssignment.json')]", + "AMBAKeyManagementInitiative": "[uri(deployment().properties.templateLink.uri, 'policyAssignments/DINE-KeyManagementAssignment.json')]", + "AMBALoadBalancingInitiative": "[uri(deployment().properties.templateLink.uri, 'policyAssignments/DINE-LoadBalancingAssignment.json')]", + "AMBANetworkChangesInitiative": "[uri(deployment().properties.templateLink.uri, 'policyAssignments/DINE-NetworkChangesAssignment.json')]", + "AMBARecoveryServicesInitiative": "[uri(deployment().properties.templateLink.uri, 'policyAssignments/DINE-RecoveryServicesAssignment.json')]", + "AMBAStorageInitiative": "[uri(deployment().properties.templateLink.uri, 'policyAssignments/DINE-StorageAssignment.json')]", + "AMBAVMInitiative": "[uri(deployment().properties.templateLink.uri, 'policyAssignments/DINE-VMAssignment.json')]", + "AMBAWebInitiative": "[uri(deployment().properties.templateLink.uri, 'policyAssignments/DINE-WebAssignment.json')]" }, // Declaring deterministic deployment names "deploymentSuffix": "[concat('-', deployment().location, '-', guid(parameters('enterpriseScaleCompanyPrefix'), parameters('currentDateTimeUtcNow')))]", "deploymentNames": { - "AMBAPolicyDeploymentName": "[take(concat('amba-Policy', variables('deploymentSuffix')), 64)]", + "AMBAResourceGroupDeploymentName": "[take(concat('amba-rg', variables('deploymentSuffix')), 64)]", + "AMBAUserAssignedManagedIdentityDeploymentName": "[take(concat('amba-Uami', variables('deploymentSuffix')), 64)]", + "AMBAUamiRoleAssignmentDeploymentName": "[take(concat('amba-ra', variables('deploymentSuffix')), 64)]", + "policyDefinitionsAutomationDeploymentName": "[take(concat('amba-Policy-Automation', variables('deploymentSuffix')), 64)]", + "policyDefinitionsComputeDeploymentName": "[take(concat('amba-Policy-Compute', variables('deploymentSuffix')), 64)]", + "policyDefinitionsHybridDeploymentName": "[take(concat('amba-Policy-Hybrid', variables('deploymentSuffix')), 64)]", + "policyDefinitionsKeyManagementDeploymentName": "[take(concat('amba-Policy-KeyManagement', variables('deploymentSuffix')), 64)]", + "policyDefinitionsMonitoringDeploymentName": "[take(concat('amba-Policy-Monitoring', variables('deploymentSuffix')), 64)]", + "policyDefinitionsNetworkDeploymentName": "[take(concat('amba-Policy-Network', variables('deploymentSuffix')), 64)]", + "policyDefinitionsNotificationAssetsDeploymentName": "[take(concat('amba-Policy-NotificationAssets', variables('deploymentSuffix')), 64)]", + "policyDefinitionsRecoveryServicesDeploymentName": "[take(concat('amba-Policy-RecoveryServices', variables('deploymentSuffix')), 64)]", + "policyDefinitionsServiceHealthDeploymentName": "[take(concat('amba-Policy-ServiceHealth', variables('deploymentSuffix')), 64)]", + "policyDefinitionsStorageDeploymentName": "[take(concat('amba-Policy-Storage', variables('deploymentSuffix')), 64)]", + "policyDefinitionsWebDeploymentName": "[take(concat('amba-Policy-Web', variables('deploymentSuffix')), 64)]", + "policySetDefinitionsDeploymentName": "[take(concat('amba-PolicySet', variables('deploymentSuffix')), 64)]", "AMBAConnectivityDeploymentName": "[take(concat('amba-Connectivity', variables('deploymentSuffix')), 64)]", "AMBAIdentityDeploymentName": "[take(concat('amba-Identity', variables('deploymentSuffix')), 64)]", - "AMBALandingZoneDeploymentName": "[take(concat('amba-LandingZone', variables('deploymentSuffix')), 64)]", "AMBAHybridVMDeploymentName": "[take(concat('amba-HybridVM', variables('deploymentSuffix')), 64)]", "AMBAManagementDeploymentName": "[take(concat('amba-Management', variables('deploymentSuffix')), 64)]", "AMBAServiceHealthDeploymentName": "[take(concat('amba-ServiceHealth', variables('deploymentSuffix')), 64)]", "AMBANotificationAssetsDeploymentName": "[take(concat('amba-NotificationAssets', variables('deploymentSuffix')), 64)]", + "AMBAKeyManagementDeploymentName": "[take(concat('amba-KeyManagement', variables('deploymentSuffix')), 64)]", + "AMBALoadBalancingDeploymentName": "[take(concat('amba-LoadBalancing', variables('deploymentSuffix')), 64)]", + "AMBANetworkChangesDeploymentName": "[take(concat('amba-NetworkChanges', variables('deploymentSuffix')), 64)]", + "AMBARecoveryServicesDeploymentName": "[take(concat('amba-RecoveryServices', variables('deploymentSuffix')), 64)]", + "AMBAStorageDeploymentName": "[take(concat('amba-Storage', variables('deploymentSuffix')), 64)]", + "AMBAVMDeploymentName": "[take(concat('amba-VM', variables('deploymentSuffix')), 64)]", + "AMBAWebDeploymentName": "[take(concat('amba-Web', variables('deploymentSuffix')), 64)]", "pidCuaDeploymentName": "[take(concat('amba-pid-', variables('cuaid'), '-' , uniqueString(deployment().location, parameters('enterpriseScaleCompanyPrefix'), parameters('currentDateTimeUtcNow'))), 64)]", - "pidCuaConnectivityDeploymentName": "[take(concat('amba-pid-', variables('cuaidConnectivity'), '-' , uniqueString(deployment().location, parameters('enterpriseScaleCompanyPrefix'), parameters('currentDateTimeUtcNow'))), 64)]", - "pidCuaIdentityDeploymentName": "[take(concat('amba-pid-', variables('cuaidIdentity'), '-' , uniqueString(deployment().location, parameters('enterpriseScaleCompanyPrefix'), parameters('currentDateTimeUtcNow'))), 64)]", - "pidCuaManagementDeploymentName": "[take(concat('amba-pid-', variables('cuaidManagement'), '-' , uniqueString(deployment().location, parameters('enterpriseScaleCompanyPrefix'), parameters('currentDateTimeUtcNow'))), 64)]", - "pidCuaLandingZoneDeploymentName": "[take(concat('amba-pid-', variables('cuaidLandingZone'), '-' , uniqueString(deployment().location, parameters('enterpriseScaleCompanyPrefix'), parameters('currentDateTimeUtcNow'))), 64)]", - "pidCuaHybridVMDeploymentName": "[take(concat('amba-pid-', variables('cuaidHybridVM'), '-' , uniqueString(deployment().location, parameters('enterpriseScaleCompanyPrefix'), parameters('currentDateTimeUtcNow'))), 64)]", - "pidCuaServiceHealthDeploymentName": "[take(concat('amba-pid-', variables('cuaidServiceHealth'), '-' , uniqueString(deployment().location, parameters('enterpriseScaleCompanyPrefix'), parameters('currentDateTimeUtcNow'))), 64)]", - "pidCuaNotificationAssetsDeploymentName": "[take(concat('amba-pid-', variables('cuaidNotificationAssets'), '-' , uniqueString(deployment().location, parameters('enterpriseScaleCompanyPrefix'), parameters('currentDateTimeUtcNow'))), 64)]", - "AMBAResourceGroupDeploymentName": "[take(concat('amba-rg', variables('deploymentSuffix')), 64)]", - "AMBAUserAssignedManagedIdentityDeploymentName": "[take(concat('amba-Uami', variables('deploymentSuffix')), 64)]", - "AMBAUamiRoleAssignmentDeploymentName": "[take(concat('amba-ra', variables('deploymentSuffix')), 64)]" + "pidCuaConnectivityDeploymentName": "[take(concat('amba-pid-Connectivity-', variables('cuaidConnectivity'), '-' , uniqueString(deployment().location, parameters('enterpriseScaleCompanyPrefix'), parameters('currentDateTimeUtcNow'))), 64)]", + "pidCuaIdentityDeploymentName": "[take(concat('amba-pid-Identity-', variables('cuaidIdentity'), '-' , uniqueString(deployment().location, parameters('enterpriseScaleCompanyPrefix'), parameters('currentDateTimeUtcNow'))), 64)]", + "pidCuaManagementDeploymentName": "[take(concat('amba-pid-Management-', variables('cuaidManagement'), '-' , uniqueString(deployment().location, parameters('enterpriseScaleCompanyPrefix'), parameters('currentDateTimeUtcNow'))), 64)]", + "pidCuaHybridVMDeploymentName": "[take(concat('amba-pid-Hybrid-', variables('cuaidHybridVM'), '-' , uniqueString(deployment().location, parameters('enterpriseScaleCompanyPrefix'), parameters('currentDateTimeUtcNow'))), 64)]", + "pidCuaServiceHealthDeploymentName": "[take(concat('amba-pid-SH-', variables('cuaidServiceHealth'), '-' , uniqueString(deployment().location, parameters('enterpriseScaleCompanyPrefix'), parameters('currentDateTimeUtcNow'))), 64)]", + "pidCuaNotificationAssetsDeploymentName": "[take(concat('amba-pid-Notification-', variables('cuaidNotificationAssets'), '-' , uniqueString(deployment().location, parameters('enterpriseScaleCompanyPrefix'), parameters('currentDateTimeUtcNow'))), 64)]", + "pidCuaAMBAAcceleratorDeploymentName": "[take(concat('amba-pid-', variables('cuaidAMBAAccelerator'), '-' , uniqueString(deployment().location, parameters('enterpriseScaleCompanyPrefix'), parameters('currentDateTimeUtcNow'))), 64)]", + "pidCuaKeyManagementDeploymentName": "[take(concat('amba-pid-KeyManagement-', variables('cuaidKeyManagement'), '-' , uniqueString(deployment().location, parameters('enterpriseScaleCompanyPrefix'), parameters('currentDateTimeUtcNow'))), 64)]", + "pidCuaLoadBalancingDeploymentName": "[take(concat('amba-pid-LoadBalancing-', variables('cuaidLoadBalancing'), '-' , uniqueString(deployment().location, parameters('enterpriseScaleCompanyPrefix'), parameters('currentDateTimeUtcNow'))), 64)]", + "pidCuaNetworkChangesDeploymentName": "[take(concat('amba-pid-NetworkChanges-', variables('cuaidNetworkChanges'), '-' , uniqueString(deployment().location, parameters('enterpriseScaleCompanyPrefix'), parameters('currentDateTimeUtcNow'))), 64)]", + "pidCuaRecoveryServicesDeploymentName": "[take(concat('amba-pid-RecoveryServices-', variables('cuaidRecoveryServices'), '-' , uniqueString(deployment().location, parameters('enterpriseScaleCompanyPrefix'), parameters('currentDateTimeUtcNow'))), 64)]", + "pidCuaStorageDeploymentName": "[take(concat('amba-pid-Storage-', variables('cuaidStorage'), '-' , uniqueString(deployment().location, parameters('enterpriseScaleCompanyPrefix'), parameters('currentDateTimeUtcNow'))), 64)]", + "pidCuaVMDeploymentName": "[take(concat('amba-pid-VM-', variables('cuaidVM'), '-' , uniqueString(deployment().location, parameters('enterpriseScaleCompanyPrefix'), parameters('currentDateTimeUtcNow'))), 64)]", + "pidCuaWebDeploymentName": "[take(concat('amba-pid-Web-', variables('cuaidWeb'), '-' , uniqueString(deployment().location, parameters('enterpriseScaleCompanyPrefix'), parameters('currentDateTimeUtcNow'))), 64)]" }, "cuaid": "d6b3b08c-5825-4b89-a62b-e3168d3d8fb0", "cuaidConnectivity": "2d69aa07-8780-4697-a431-79882cb9f00e", "cuaidIdentity": "8d257c20-97bf-4d14-acb3-38dd1436d13a", "cuaidManagement": "d87415c4-01ef-4667-af89-0b5adc14af1b", - "cuaidLandingZone": "7bcfc615-be78-43da-b81d-98959a9465a5", "cuaidServiceHealth": "860d2afd-b71e-452f-9d3a-e56196cba570", "cuaidNotificationAssets": "eabaaf0b-eed4-48a9-9f91-4f7e431ba807", - "cuaidHybridVM": "b5c25c0c-dfbf-4414-bedb-f48ab00d0f9e" + "cuaidHybridVM": "b5c25c0c-dfbf-4414-bedb-f48ab00d0f9e", + "cuaidAMBAAccelerator": "dddb1f42-f9d8-48e3-9e6b-f1ce3e9c2c76", + "cuaidKeyManagement": "65cb78a2-0744-4785-9093-aeb772ecdd7b", + "cuaidLoadBalancing": "5156f7d1-8543-49c0-ac09-76db1170d42a", + "cuaidNetworkChanges": "e61a27ea-ed9e-496e-8fd2-489bfa3b6e4f", + "cuaidRecoveryServices": "b45e8b7b-e0a2-4af4-b3af-8b2af4020dcc", + "cuaidStorage": "c0eb5ea9-033b-4c1b-be71-b3088e7a2e2b", + "cuaidVM": "3ace674d-9502-4f4a-98ba-a2277c01ccf8", + "cuaidWeb": "a80aedbd-3157-4335-94c7-7e7db459a647" }, "resources": [ + // MARK: Deploy RG // Creating resource group in the Management subscription. { "condition": "[equals(parameters('bringYourOwnUserAssignedManagedIdentity'), 'No')]", @@ -418,6 +633,7 @@ } } }, + // MARK: Deploy UAMI // Creating User Assigned Managed Identity for monitoring purpose using ARG query based alerts. { "condition": "[equals(parameters('bringYourOwnUserAssignedManagedIdentity'), 'No')]", @@ -448,6 +664,7 @@ } } }, + // MARK: Assign role // Assigning Monitoring Reader role to the User Assigned Managed Identity at the pseudo root management group. { "condition": "[equals(parameters('bringYourOwnUserAssignedManagedIdentity'), 'No')]", @@ -514,11 +731,12 @@ } } }, - // Deploying AMBA-ALZ custom policies. + // MARK: Deploy Policies + // Automation Policy Definitions { "type": "Microsoft.Resources/deployments", "apiVersion": "2020-10-01", - "name": "[variables('deploymentNames').AMBAPolicyDeploymentName]", + "name": "[variables('deploymentNames').policyDefinitionsAutomationDeploymentName]", "location": "[deployment().location]", "scope": "[concat('Microsoft.Management/managementGroups/', parameters('enterpriseScaleCompanyPrefix'))]", "dependsOn": [], @@ -526,7 +744,7 @@ "mode": "Incremental", "templateLink": { "contentVersion": "1.0.0.0", - "uri": "[variables('deploymentUris').policyDefinitionsAMBA]" + "uri": "[variables('deploymentUris').policyDefinitionsAutomation]" }, "parameters": { "topLevelManagementGroupPrefix": { @@ -535,243 +753,662 @@ } } }, - // Adding delay to ensure policy deployment is completed before policy assignments + // Compute Policy Definitions { "type": "Microsoft.Resources/deployments", "apiVersion": "2020-10-01", - "name": "[concat('amba-PreparingToLaunch', copyIndex())]", + "name": "[variables('deploymentNames').policyDefinitionsComputeDeploymentName]", "location": "[deployment().location]", "scope": "[concat('Microsoft.Management/managementGroups/', parameters('enterpriseScaleCompanyPrefix'))]", - "dependsOn": [ - "[variables('deploymentNames').AMBAPolicyDeploymentName]" - ], - "copy": { - "batchSize": 1, - "count": "[parameters('delayCount')]", - "mode": "Serial", - "name": "ambaPolicyCompletion" - }, + "dependsOn": [], "properties": { "mode": "Incremental", - "template": { - "$schema": "https://schema.management.azure.com/schemas/2019-08-01/managementGroupDeploymentTemplate.json#", + "templateLink": { "contentVersion": "1.0.0.0", - "parameters": {}, - "resources": [], - "outputs": {} + "uri": "[variables('deploymentUris').policyDefinitionsCompute]" + }, + "parameters": { + "topLevelManagementGroupPrefix": { + "value": "[parameters('enterpriseScaleCompanyPrefix')]" + } } } }, - // Assigning AMBA Connectivity PolicySet to the connectivity management group if condition is true + // Hybrid Policy Definitions { - "condition": "[equals(parameters('enableAMBAConnectivity'), 'Yes')]", "type": "Microsoft.Resources/deployments", "apiVersion": "2020-10-01", - "name": "[variables('deploymentNames').AMBAConnectivityDeploymentName]", - "scope": "[concat('Microsoft.Management/managementGroups/', parameters('connectivityManagementGroup'))]", + "name": "[variables('deploymentNames').policyDefinitionsHybridDeploymentName]", "location": "[deployment().location]", - "dependsOn": [ - "ambaPolicyCompletion" - ], + "scope": "[concat('Microsoft.Management/managementGroups/', parameters('enterpriseScaleCompanyPrefix'))]", + "dependsOn": [], "properties": { "mode": "Incremental", "templateLink": { "contentVersion": "1.0.0.0", - "uri": "[variables('deploymentUris').AMBAConnectivityInitiative]" + "uri": "[variables('deploymentUris').policyDefinitionsHybrid]" }, "parameters": { "topLevelManagementGroupPrefix": { "value": "[parameters('enterpriseScaleCompanyPrefix')]" - }, - "policyAssignmentParameters": { - "value": "[variables('policyAssignmentParametersConnectivity')]" } } } }, - // Assigning AMBA Identity PolicySet to the Indentity management group if condition is true + // Key Management Policy Definitions { - "condition": "[equals(parameters('enableAMBAIdentity'), 'Yes')]", "type": "Microsoft.Resources/deployments", "apiVersion": "2020-10-01", - "name": "[variables('deploymentNames').AMBAIdentityDeploymentName]", - "scope": "[concat('Microsoft.Management/managementGroups/', parameters('identityManagementGroup'))]", + "name": "[variables('deploymentNames').policyDefinitionsKeyManagementDeploymentName]", "location": "[deployment().location]", - "dependsOn": [ - "ambaPolicyCompletion" - ], + "scope": "[concat('Microsoft.Management/managementGroups/', parameters('enterpriseScaleCompanyPrefix'))]", + "dependsOn": [], "properties": { "mode": "Incremental", "templateLink": { "contentVersion": "1.0.0.0", - "uri": "[variables('deploymentUris').AMBAIdentityInitiative]" + "uri": "[variables('deploymentUris').policyDefinitionsKeyManagement]" }, "parameters": { "topLevelManagementGroupPrefix": { "value": "[parameters('enterpriseScaleCompanyPrefix')]" - }, - "policyAssignmentParameters": { - "value": "[variables('policyAssignmentParametersIdentity')]" } } } }, - // Assigning AMBA LandingZone PolicySet to the LandingZone management group if condition is true + // Monitoring Policy Definitions { - "condition": "[equals(parameters('enableAMBALandingZone'), 'Yes')]", "type": "Microsoft.Resources/deployments", "apiVersion": "2020-10-01", - "name": "[variables('deploymentNames').AMBALandingZoneDeploymentName]", - "scope": "[concat('Microsoft.Management/managementGroups/', parameters('LandingZoneManagementGroup'))]", + "name": "[variables('deploymentNames').policyDefinitionsMonitoringDeploymentName]", "location": "[deployment().location]", - "dependsOn": [ - "ambaPolicyCompletion" - ], + "scope": "[concat('Microsoft.Management/managementGroups/', parameters('enterpriseScaleCompanyPrefix'))]", + "dependsOn": [], "properties": { "mode": "Incremental", "templateLink": { "contentVersion": "1.0.0.0", - "uri": "[variables('deploymentUris').AMBALandingZoneInitiative]" + "uri": "[variables('deploymentUris').policyDefinitionsMonitoring]" }, "parameters": { "topLevelManagementGroupPrefix": { "value": "[parameters('enterpriseScaleCompanyPrefix')]" - }, - "policyAssignmentParameters": { - "value": "[variables('policyAssignmentParametersLandingZone')]" } } } }, - // Assigning AMBA HybridVM PolicySet to the LandingZone management group if condition is true + // Network Policy Definitions { - "condition": "[equals(parameters('enableAMBAHybridVM'), 'Yes')]", "type": "Microsoft.Resources/deployments", "apiVersion": "2020-10-01", - "name": "[variables('deploymentNames').AMBAHybridVMDeploymentName]", - "scope": "[concat('Microsoft.Management/managementGroups/', parameters('LandingZoneManagementGroup'))]", + "name": "[variables('deploymentNames').policyDefinitionsNetworkDeploymentName]", "location": "[deployment().location]", - "dependsOn": [ - "ambaPolicyCompletion" - ], + "scope": "[concat('Microsoft.Management/managementGroups/', parameters('enterpriseScaleCompanyPrefix'))]", + "dependsOn": [], "properties": { "mode": "Incremental", "templateLink": { "contentVersion": "1.0.0.0", - "uri": "[variables('deploymentUris').AMBAHybridVMInitiative]" + "uri": "[variables('deploymentUris').policyDefinitionsNetwork]" }, "parameters": { "topLevelManagementGroupPrefix": { "value": "[parameters('enterpriseScaleCompanyPrefix')]" - }, - "policyAssignmentParameters": { - "value": "[variables('policyAssignmentParametersHybridVM')]" } } } }, - // Assigning AMBA management PolicySet to the management management group if condition is true + // Notification-Assets Policy Definitions { - "condition": "[equals(parameters('enableAMBAManagement'), 'Yes')]", "type": "Microsoft.Resources/deployments", "apiVersion": "2020-10-01", - "name": "[variables('deploymentNames').AMBAManagementDeploymentName]", - "scope": "[concat('Microsoft.Management/managementGroups/', parameters('managementManagementGroup'))]", + "name": "[variables('deploymentNames').policyDefinitionsNotificationAssetsDeploymentName]", "location": "[deployment().location]", - "dependsOn": [ - "ambaPolicyCompletion" - ], + "scope": "[concat('Microsoft.Management/managementGroups/', parameters('enterpriseScaleCompanyPrefix'))]", + "dependsOn": [], "properties": { "mode": "Incremental", "templateLink": { "contentVersion": "1.0.0.0", - "uri": "[variables('deploymentUris').AMBAManagementInitiative]" + "uri": "[variables('deploymentUris').policyDefinitionsNotificationAssets]" }, "parameters": { "topLevelManagementGroupPrefix": { "value": "[parameters('enterpriseScaleCompanyPrefix')]" - }, - "policyAssignmentParameters": { - "value": "[variables('policyAssignmentParametersManagement')]" } } } }, - // Assigning AMBA service health PolicySet to the service health management group if condition is true + // Recovery Services Policy Definitions { - "condition": "[equals(parameters('enableAMBAServiceHealth'), 'Yes')]", "type": "Microsoft.Resources/deployments", "apiVersion": "2020-10-01", - "name": "[variables('deploymentNames').AMBAServiceHealthDeploymentName]", - "scope": "[concat('Microsoft.Management/managementGroups/', parameters('enterpriseScaleCompanyPrefix'))]", + "name": "[variables('deploymentNames').policyDefinitionsRecoveryServicesDeploymentName]", "location": "[deployment().location]", - "dependsOn": [ - "ambaPolicyCompletion" - ], + "scope": "[concat('Microsoft.Management/managementGroups/', parameters('enterpriseScaleCompanyPrefix'))]", + "dependsOn": [], "properties": { "mode": "Incremental", "templateLink": { "contentVersion": "1.0.0.0", - "uri": "[variables('deploymentUris').AMBAServiceHealthInitiative]" + "uri": "[variables('deploymentUris').policyDefinitionsRecoveryServices]" }, "parameters": { "topLevelManagementGroupPrefix": { "value": "[parameters('enterpriseScaleCompanyPrefix')]" - }, - "policyAssignmentParameters": { - "value": "[variables('policyAssignmentParametersServiceHealth')]" } } } }, - // Assigning AMBA notification assets PolicySet to the pseudo root management group if condition is true + // ServiceHealth Policy Definitions { - "condition": "[equals(parameters('enableAMBANotificationAssets'), 'Yes')]", "type": "Microsoft.Resources/deployments", "apiVersion": "2020-10-01", - "name": "[variables('deploymentNames').AMBANotificationAssetsDeploymentName]", - "scope": "[concat('Microsoft.Management/managementGroups/', parameters('enterpriseScaleCompanyPrefix'))]", + "name": "[variables('deploymentNames').policyDefinitionsServiceHealthDeploymentName]", "location": "[deployment().location]", - "dependsOn": [ - "ambaPolicyCompletion" - ], + "scope": "[concat('Microsoft.Management/managementGroups/', parameters('enterpriseScaleCompanyPrefix'))]", + "dependsOn": [], "properties": { "mode": "Incremental", "templateLink": { "contentVersion": "1.0.0.0", - "uri": "[variables('deploymentUris').AMBANotificationAssetsInitiative]" + "uri": "[variables('deploymentUris').policyDefinitionsServiceHealth]" }, "parameters": { "topLevelManagementGroupPrefix": { "value": "[parameters('enterpriseScaleCompanyPrefix')]" - }, - "policyAssignmentParameters": { - "value": "[variables('policyAssignmentParametersNotificationAssets')]" } } } }, - // Deploying general telemetry if not opted out + // Storage Policy Definitions { - "condition": "[equals(parameters('telemetryOptOut'), 'No')]", - "apiVersion": "2020-06-01", - "name": "[variables('deploymentNames').pidCuaDeploymentName]", - "location": "[deployment().location]", "type": "Microsoft.Resources/deployments", + "apiVersion": "2020-10-01", + "name": "[variables('deploymentNames').policyDefinitionsStorageDeploymentName]", + "location": "[deployment().location]", + "scope": "[concat('Microsoft.Management/managementGroups/', parameters('enterpriseScaleCompanyPrefix'))]", + "dependsOn": [], "properties": { "mode": "Incremental", - "template": { - "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", + "templateLink": { "contentVersion": "1.0.0.0", - "resources": [] - } - } - }, - // Deploying connectivity PolicySet telemetry if not opted out + "uri": "[variables('deploymentUris').policyDefinitionsStorage]" + }, + "parameters": { + "topLevelManagementGroupPrefix": { + "value": "[parameters('enterpriseScaleCompanyPrefix')]" + } + } + } + }, + // Web Policy Definitions { - "condition": "[and(equals(parameters('telemetryOptOut'), 'No'), equals(parameters('enableAMBAConnectivity'), 'Yes'))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2020-10-01", + "name": "[variables('deploymentNames').policyDefinitionsWebDeploymentName]", + "location": "[deployment().location]", + "scope": "[concat('Microsoft.Management/managementGroups/', parameters('enterpriseScaleCompanyPrefix'))]", + "dependsOn": [], + "properties": { + "mode": "Incremental", + "templateLink": { + "contentVersion": "1.0.0.0", + "uri": "[variables('deploymentUris').policyDefinitionsWeb]" + }, + "parameters": { + "topLevelManagementGroupPrefix": { + "value": "[parameters('enterpriseScaleCompanyPrefix')]" + } + } + } + }, + // Policy Set Definitions + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2020-10-01", + "name": "[variables('deploymentNames').policySetDefinitionsDeploymentName]", + "location": "[deployment().location]", + "scope": "[concat('Microsoft.Management/managementGroups/', parameters('enterpriseScaleCompanyPrefix'))]", + "dependsOn": [ + "[variables('deploymentNames').policyDefinitionsAutomationDeploymentName]", + "[variables('deploymentNames').policyDefinitionsComputeDeploymentName]", + "[variables('deploymentNames').policyDefinitionsHybridDeploymentName]", + "[variables('deploymentNames').policyDefinitionsKeyManagementDeploymentName]", + "[variables('deploymentNames').policyDefinitionsMonitoringDeploymentName]", + "[variables('deploymentNames').policyDefinitionsNetworkDeploymentName]", + "[variables('deploymentNames').policyDefinitionsNotificationAssetsDeploymentName]", + "[variables('deploymentNames').policyDefinitionsRecoveryServicesDeploymentName]", + "[variables('deploymentNames').policyDefinitionsServiceHealthDeploymentName]", + "[variables('deploymentNames').policyDefinitionsStorageDeploymentName]", + "[variables('deploymentNames').policyDefinitionsWebDeploymentName]" + ], + "properties": { + "mode": "Incremental", + "templateLink": { + "contentVersion": "1.0.0.0", + "uri": "[variables('deploymentUris').policySetDefinitions]" + }, + "parameters": { + "topLevelManagementGroupPrefix": { + "value": "[parameters('enterpriseScaleCompanyPrefix')]" + } + } + } + }, + // MARK: Delay + // Adding delay to ensure policy deployment is completed before policy assignments + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2020-10-01", + "name": "[concat('amba-PreparingToLaunch', copyIndex())]", + "location": "[deployment().location]", + "scope": "[concat('Microsoft.Management/managementGroups/', parameters('enterpriseScaleCompanyPrefix'))]", + "dependsOn": [ + "[variables('deploymentNames').policySetDefinitionsDeploymentName]" + ], + "copy": { + "batchSize": 1, + "count": "[parameters('delayCount')]", + "mode": "Serial", + "name": "ambaPolicyCompletion" + }, + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-08-01/managementGroupDeploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": {}, + "resources": [], + "outputs": {} + } + } + }, + // MARK: Assign Policies + // Assigning AMBA Connectivity PolicySet to the connectivity management group if condition is true + { + "condition": "[equals(parameters('enableAMBAConnectivity'), 'Yes')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2020-10-01", + "name": "[variables('deploymentNames').AMBAConnectivityDeploymentName]", + "scope": "[concat('Microsoft.Management/managementGroups/', parameters('connectivityManagementGroup'))]", + "location": "[deployment().location]", + "dependsOn": [ + "ambaPolicyCompletion" + ], + "properties": { + "mode": "Incremental", + "templateLink": { + "contentVersion": "1.0.0.0", + "uri": "[variables('deploymentUris').AMBAConnectivityInitiative]" + }, + "parameters": { + "topLevelManagementGroupPrefix": { + "value": "[parameters('enterpriseScaleCompanyPrefix')]" + }, + "policyAssignmentParameters": { + "value": "[variables('policyAssignmentParametersConnectivity')]" + } + } + } + }, + // Assigning AMBA Identity PolicySet to the Identity management group if condition is true + { + "condition": "[equals(parameters('enableAMBAIdentity'), 'Yes')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2020-10-01", + "name": "[variables('deploymentNames').AMBAIdentityDeploymentName]", + "scope": "[concat('Microsoft.Management/managementGroups/', parameters('identityManagementGroup'))]", + "location": "[deployment().location]", + "dependsOn": [ + "ambaPolicyCompletion" + ], + "properties": { + "mode": "Incremental", + "templateLink": { + "contentVersion": "1.0.0.0", + "uri": "[variables('deploymentUris').AMBAIdentityInitiative]" + }, + "parameters": { + "topLevelManagementGroupPrefix": { + "value": "[parameters('enterpriseScaleCompanyPrefix')]" + }, + "policyAssignmentParameters": { + "value": "[variables('policyAssignmentParametersIdentity')]" + } + } + } + }, + // Assigning AMBA management PolicySet to the Management management group if condition is true + { + "condition": "[equals(parameters('enableAMBAManagement'), 'Yes')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2020-10-01", + "name": "[variables('deploymentNames').AMBAManagementDeploymentName]", + "scope": "[concat('Microsoft.Management/managementGroups/', parameters('managementManagementGroup'))]", + "location": "[deployment().location]", + "dependsOn": [ + "ambaPolicyCompletion", + "[variables('deploymentNames').AMBAUamiRoleAssignmentDeploymentName]" + ], + "properties": { + "mode": "Incremental", + "templateLink": { + "contentVersion": "1.0.0.0", + "uri": "[variables('deploymentUris').AMBAManagementInitiative]" + }, + "parameters": { + "topLevelManagementGroupPrefix": { + "value": "[parameters('enterpriseScaleCompanyPrefix')]" + }, + "scope": { + "value": "[parameters('managementManagementGroup')]" + }, + "bringYourOwnUserAssignedManagedIdentity": { + "value": "[parameters('bringYourOwnUserAssignedManagedIdentity')]" + }, + "policyAssignmentParameters": { + "value": "[variables('policyAssignmentParametersManagement')]" + } + } + } + }, + // Assigning AMBA service health PolicySet to the pseudo root management group if condition is true + { + "condition": "[equals(parameters('enableAMBAServiceHealth'), 'Yes')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2020-10-01", + "name": "[variables('deploymentNames').AMBAServiceHealthDeploymentName]", + "scope": "[concat('Microsoft.Management/managementGroups/', parameters('enterpriseScaleCompanyPrefix'))]", + "location": "[deployment().location]", + "dependsOn": [ + "ambaPolicyCompletion" + ], + "properties": { + "mode": "Incremental", + "templateLink": { + "contentVersion": "1.0.0.0", + "uri": "[variables('deploymentUris').AMBAServiceHealthInitiative]" + }, + "parameters": { + "topLevelManagementGroupPrefix": { + "value": "[parameters('enterpriseScaleCompanyPrefix')]" + }, + "policyAssignmentParameters": { + "value": "[variables('policyAssignmentParametersServiceHealth')]" + } + } + } + }, + // Assigning AMBA notification assets PolicySet to the pseudo root management group if condition is true + { + "condition": "[equals(parameters('enableAMBANotificationAssets'), 'Yes')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2020-10-01", + "name": "[variables('deploymentNames').AMBANotificationAssetsDeploymentName]", + "scope": "[concat('Microsoft.Management/managementGroups/', parameters('enterpriseScaleCompanyPrefix'))]", + "location": "[deployment().location]", + "dependsOn": [ + "ambaPolicyCompletion" + ], + "properties": { + "mode": "Incremental", + "templateLink": { + "contentVersion": "1.0.0.0", + "uri": "[variables('deploymentUris').AMBANotificationAssetsInitiative]" + }, + "parameters": { + "topLevelManagementGroupPrefix": { + "value": "[parameters('enterpriseScaleCompanyPrefix')]" + }, + "policyAssignmentParameters": { + "value": "[variables('policyAssignmentParametersNotificationAssets')]" + } + } + } + }, + // Assigning AMBA HybridVM PolicySet to the LandingZone management group if condition is true + { + "condition": "[equals(parameters('enableAMBAHybridVM'), 'Yes')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2020-10-01", + "name": "[variables('deploymentNames').AMBAHybridVMDeploymentName]", + "scope": "[concat('Microsoft.Management/managementGroups/', parameters('LandingZoneManagementGroup'))]", + "location": "[deployment().location]", + "dependsOn": [ + "ambaPolicyCompletion", + "[variables('deploymentNames').AMBAUamiRoleAssignmentDeploymentName]" + ], + "properties": { + "mode": "Incremental", + "templateLink": { + "contentVersion": "1.0.0.0", + "uri": "[variables('deploymentUris').AMBAHybridVMInitiative]" + }, + "parameters": { + "topLevelManagementGroupPrefix": { + "value": "[parameters('enterpriseScaleCompanyPrefix')]" + }, + "scope": { + "value": "[parameters('LandingZoneManagementGroup')]" + }, + "uamiScope": { + "value": "[parameters('managementManagementGroup')]" + }, + "bringYourOwnUserAssignedManagedIdentity": { + "value": "[parameters('bringYourOwnUserAssignedManagedIdentity')]" + }, + "policyAssignmentParameters": { + "value": "[variables('policyAssignmentParametersHybridVM')]" + } + } + } + }, + // Assigning AMBA Key Management PolicySet to the Landing Zone management group if condition is true + { + "condition": "[equals(parameters('enableAMBAKeyManagement'), 'Yes')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2020-10-01", + "name": "[variables('deploymentNames').AMBAKeyManagementDeploymentName]", + "scope": "[concat('Microsoft.Management/managementGroups/', parameters('LandingZoneManagementGroup'))]", + "location": "[deployment().location]", + "dependsOn": [ + "ambaPolicyCompletion" + ], + "properties": { + "mode": "Incremental", + "templateLink": { + "contentVersion": "1.0.0.0", + "uri": "[variables('deploymentUris').AMBAKeyManagementInitiative]" + }, + "parameters": { + "topLevelManagementGroupPrefix": { + "value": "[parameters('enterpriseScaleCompanyPrefix')]" + }, + "policyAssignmentParameters": { + "value": "[variables('policyAssignmentParametersKeyManagement')]" + } + } + } + }, + // Assigning AMBA Load Balancing PolicySet to the Landing Zone management group if condition is true + { + "condition": "[equals(parameters('enableAMBALoadBalancing'), 'Yes')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2020-10-01", + "name": "[variables('deploymentNames').AMBALoadBalancingDeploymentName]", + "scope": "[concat('Microsoft.Management/managementGroups/', parameters('LandingZoneManagementGroup'))]", + "location": "[deployment().location]", + "dependsOn": [ + "ambaPolicyCompletion" + ], + "properties": { + "mode": "Incremental", + "templateLink": { + "contentVersion": "1.0.0.0", + "uri": "[variables('deploymentUris').AMBALoadBalancingInitiative]" + }, + "parameters": { + "topLevelManagementGroupPrefix": { + "value": "[parameters('enterpriseScaleCompanyPrefix')]" + }, + "policyAssignmentParameters": { + "value": "[variables('policyAssignmentParametersLoadBalancing')]" + } + } + } + }, + // Assigning AMBA Network Changes PolicySet to the Landing Zone management group if condition is true + { + "condition": "[equals(parameters('enableAMBANetworkChanges'), 'Yes')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2020-10-01", + "name": "[variables('deploymentNames').AMBANetworkChangesDeploymentName]", + "scope": "[concat('Microsoft.Management/managementGroups/', parameters('LandingZoneManagementGroup'))]", + "location": "[deployment().location]", + "dependsOn": [ + "ambaPolicyCompletion" + ], + "properties": { + "mode": "Incremental", + "templateLink": { + "contentVersion": "1.0.0.0", + "uri": "[variables('deploymentUris').AMBANetworkChangesInitiative]" + }, + "parameters": { + "topLevelManagementGroupPrefix": { + "value": "[parameters('enterpriseScaleCompanyPrefix')]" + }, + "policyAssignmentParameters": { + "value": "[variables('policyAssignmentParametersNetworkChanges')]" + } + } + } + }, + // Assigning AMBA Recovery Services PolicySet to the Landing Zone management group if condition is true + { + "condition": "[equals(parameters('enableAMBARecoveryServices'), 'Yes')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2020-10-01", + "name": "[variables('deploymentNames').AMBARecoveryServicesDeploymentName]", + "scope": "[concat('Microsoft.Management/managementGroups/', parameters('LandingZoneManagementGroup'))]", + "location": "[deployment().location]", + "dependsOn": [ + "ambaPolicyCompletion" + ], + "properties": { + "mode": "Incremental", + "templateLink": { + "contentVersion": "1.0.0.0", + "uri": "[variables('deploymentUris').AMBARecoveryServicesInitiative]" + }, + "parameters": { + "topLevelManagementGroupPrefix": { + "value": "[parameters('enterpriseScaleCompanyPrefix')]" + }, + "policyAssignmentParameters": { + "value": "[variables('policyAssignmentParametersRecoveryServices')]" + } + } + } + }, + // Assigning AMBA Storage PolicySet to the Landing Zone management group if condition is true + { + "condition": "[equals(parameters('enableAMBAStorage'), 'Yes')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2020-10-01", + "name": "[variables('deploymentNames').AMBAStorageDeploymentName]", + "scope": "[concat('Microsoft.Management/managementGroups/', parameters('LandingZoneManagementGroup'))]", + "location": "[deployment().location]", + "dependsOn": [ + "ambaPolicyCompletion" + ], + "properties": { + "mode": "Incremental", + "templateLink": { + "contentVersion": "1.0.0.0", + "uri": "[variables('deploymentUris').AMBAStorageInitiative]" + }, + "parameters": { + "topLevelManagementGroupPrefix": { + "value": "[parameters('enterpriseScaleCompanyPrefix')]" + }, + "policyAssignmentParameters": { + "value": "[variables('policyAssignmentParametersStorage')]" + } + } + } + }, + // Assigning AMBA VM PolicySet to the Landing Zone management group if condition is true + { + "condition": "[equals(parameters('enableAMBAVM'), 'Yes')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2020-10-01", + "name": "[variables('deploymentNames').AMBAVMDeploymentName]", + "scope": "[concat('Microsoft.Management/managementGroups/', parameters('LandingZoneManagementGroup'))]", + "location": "[deployment().location]", + "dependsOn": [ + "ambaPolicyCompletion", + "[variables('deploymentNames').AMBAUamiRoleAssignmentDeploymentName]" + ], + "properties": { + "mode": "Incremental", + "templateLink": { + "contentVersion": "1.0.0.0", + "uri": "[variables('deploymentUris').AMBAVMInitiative]" + }, + "parameters": { + "topLevelManagementGroupPrefix": { + "value": "[parameters('enterpriseScaleCompanyPrefix')]" + }, + "scope": { + "value": "[parameters('LandingZoneManagementGroup')]" + }, + "uamiScope": { + "value": "[parameters('managementManagementGroup')]" + }, + "bringYourOwnUserAssignedManagedIdentity": { + "value": "[parameters('bringYourOwnUserAssignedManagedIdentity')]" + }, + "policyAssignmentParameters": { + "value": "[variables('policyAssignmentParametersVM')]" + } + } + } + }, + // Assigning AMBA Web PolicySet to the Landing Zone group if condition is true + { + "condition": "[equals(parameters('enableAMBAWeb'), 'Yes')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2020-10-01", + "name": "[variables('deploymentNames').AMBAWebDeploymentName]", + "scope": "[concat('Microsoft.Management/managementGroups/', parameters('LandingZoneManagementGroup'))]", + "location": "[deployment().location]", + "dependsOn": [ + "ambaPolicyCompletion" + ], + "properties": { + "mode": "Incremental", + "templateLink": { + "contentVersion": "1.0.0.0", + "uri": "[variables('deploymentUris').AMBAWebInitiative]" + }, + "parameters": { + "topLevelManagementGroupPrefix": { + "value": "[parameters('enterpriseScaleCompanyPrefix')]" + }, + "policyAssignmentParameters": { + "value": "[variables('policyAssignmentParametersWeb')]" + } + } + } + }, + // MARK: Deploy telemetry + // Deploying general telemetry if not opted out and not deploying from ALZ Portal Accelerator + { + "condition": "[and(equals(parameters('telemetryOptOut'), 'No'), equals(parameters('deployALZPortalAccelerator'), 'No'))]", "apiVersion": "2020-06-01", - "name": "[variables('deploymentNames').pidCuaConnectivityDeploymentName]", + "name": "[if(equals(parameters('deployAMBAPortalAccelerator'), 'No'),variables('deploymentNames').pidCuaDeploymentName, variables('deploymentNames').pidCuaAMBAAcceleratorDeploymentName)]", "location": "[deployment().location]", "type": "Microsoft.Resources/deployments", "properties": { @@ -783,11 +1420,11 @@ } } }, - // Deploying identity PolicySet telemetry if not opted out + // Deploying connectivity PolicySet telemetry if not opted out { - "condition": "[and(equals(parameters('telemetryOptOut'), 'No'), equals(parameters('enableAMBAIdentity'), 'Yes'))]", + "condition": "[and(equals(parameters('telemetryOptOut'), 'No'), equals(parameters('enableAMBAConnectivity'), 'Yes'))]", "apiVersion": "2020-06-01", - "name": "[variables('deploymentNames').pidCuaIdentityDeploymentName]", + "name": "[variables('deploymentNames').pidCuaConnectivityDeploymentName]", "location": "[deployment().location]", "type": "Microsoft.Resources/deployments", "properties": { @@ -799,11 +1436,11 @@ } } }, - // Deploying management PolicySet telemetry if not opted out + // Deploying identity PolicySet telemetry if not opted out { - "condition": "[and(equals(parameters('telemetryOptOut'), 'No'), equals(parameters('enableAMBAManagement'), 'Yes'))]", + "condition": "[and(equals(parameters('telemetryOptOut'), 'No'), equals(parameters('enableAMBAIdentity'), 'Yes'))]", "apiVersion": "2020-06-01", - "name": "[variables('deploymentNames').pidCuaManagementDeploymentName]", + "name": "[variables('deploymentNames').pidCuaIdentityDeploymentName]", "location": "[deployment().location]", "type": "Microsoft.Resources/deployments", "properties": { @@ -815,11 +1452,11 @@ } } }, - // Deploying landing zone PolicySet telemetry if not opted out + // Deploying management PolicySet telemetry if not opted out { - "condition": "[and(equals(parameters('telemetryOptOut'), 'No'), equals(parameters('enableAMBALandingZone'), 'Yes'))]", + "condition": "[and(equals(parameters('telemetryOptOut'), 'No'), equals(parameters('enableAMBAManagement'), 'Yes'))]", "apiVersion": "2020-06-01", - "name": "[variables('deploymentNames').pidCuaLandingZoneDeploymentName]", + "name": "[variables('deploymentNames').pidCuaManagementDeploymentName]", "location": "[deployment().location]", "type": "Microsoft.Resources/deployments", "properties": { @@ -878,6 +1515,118 @@ "resources": [] } } + }, + // Deploying Key Management PolicySet telemetry if not opted out + { + "condition": "[and(equals(parameters('telemetryOptOut'), 'No'), equals(parameters('enableAMBAKeyManagement'), 'Yes'))]", + "apiVersion": "2020-06-01", + "name": "[variables('deploymentNames').pidCuaKeyManagementDeploymentName]", + "location": "[deployment().location]", + "type": "Microsoft.Resources/deployments", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [] + } + } + }, + // Deploying Load Balancing PolicySet telemetry if not opted out + { + "condition": "[and(equals(parameters('telemetryOptOut'), 'No'), equals(parameters('enableAMBALoadBalancing'), 'Yes'))]", + "apiVersion": "2020-06-01", + "name": "[variables('deploymentNames').pidCuaLoadBalancingDeploymentName]", + "location": "[deployment().location]", + "type": "Microsoft.Resources/deployments", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [] + } + } + }, + // Deploying Network Changes PolicySet telemetry if not opted out + { + "condition": "[and(equals(parameters('telemetryOptOut'), 'No'), equals(parameters('enableAMBANetworkChanges'), 'Yes'))]", + "apiVersion": "2020-06-01", + "name": "[variables('deploymentNames').pidCuaNetworkChangesDeploymentName]", + "location": "[deployment().location]", + "type": "Microsoft.Resources/deployments", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [] + } + } + }, + // Deploying Recovery Services PolicySet telemetry if not opted out + { + "condition": "[and(equals(parameters('telemetryOptOut'), 'No'), equals(parameters('enableAMBARecoveryServices'), 'Yes'))]", + "apiVersion": "2020-06-01", + "name": "[variables('deploymentNames').pidCuaRecoveryServicesDeploymentName]", + "location": "[deployment().location]", + "type": "Microsoft.Resources/deployments", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [] + } + } + }, + // Deploying Storage PolicySet telemetry if not opted out + { + "condition": "[and(equals(parameters('telemetryOptOut'), 'No'), equals(parameters('enableAMBAStorage'), 'Yes'))]", + "apiVersion": "2020-06-01", + "name": "[variables('deploymentNames').pidCuaStorageDeploymentName]", + "location": "[deployment().location]", + "type": "Microsoft.Resources/deployments", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [] + } + } + }, + // Deploying VM PolicySet telemetry if not opted out + { + "condition": "[and(equals(parameters('telemetryOptOut'), 'No'), equals(parameters('enableAMBAVM'), 'Yes'))]", + "apiVersion": "2020-06-01", + "name": "[variables('deploymentNames').pidCuaVMDeploymentName]", + "location": "[deployment().location]", + "type": "Microsoft.Resources/deployments", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [] + } + } + }, + // Deploying Web PolicySet telemetry if not opted out + { + "condition": "[and(equals(parameters('telemetryOptOut'), 'No'), equals(parameters('enableAMBAWeb'), 'Yes'))]", + "apiVersion": "2020-06-01", + "name": "[variables('deploymentNames').pidCuaWebDeploymentName]", + "location": "[deployment().location]", + "type": "Microsoft.Resources/deployments", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [] + } + } } ], "outputs": { diff --git a/patterns/alz/alzArm.param.json b/patterns/alz/alzArm.param.json index e8779ba2d..e6d23b0b9 100644 --- a/patterns/alz/alzArm.param.json +++ b/patterns/alz/alzArm.param.json @@ -26,9 +26,6 @@ "enableAMBAIdentity": { "value": "Yes" }, - "enableAMBALandingZone": { - "value": "Yes" - }, "enableAMBAManagement": { "value": "Yes" }, @@ -41,6 +38,27 @@ "enableAMBAHybridVM": { "value": "Yes" }, + "enableAMBAKeyManagement": { + "value": "Yes" + }, + "enableAMBALoadBalancing": { + "value": "Yes" + }, + "enableAMBANetworkChanges": { + "value": "Yes" + }, + "enableAMBARecoveryServices": { + "value": "Yes" + }, + "enableAMBAStorage": { + "value": "Yes" + }, + "enableAMBAVM": { + "value": "Yes" + }, + "enableAMBAWeb": { + "value": "Yes" + }, "telemetryOptOut": { "value": "No" }, @@ -67,8 +85,19 @@ "Project": "amba-monitoring" } }, + "ALZMonitorDisableTagName": { + "value": "MonitorDisable" + }, + "ALZMonitorDisableTagValues": { + "value": [ + "true", + "Test", + "Dev", + "Sandbox" + ] + }, "ALZMonitorActionGroupEmail": { - "value": "" + "value": [] }, "ALZLogicappResourceId": { "value": "" @@ -77,13 +106,13 @@ "value": "" }, "ALZArmRoleId": { - "value": "" + "value": [] }, "ALZEventHubResourceId": { - "value": "" + "value": [] }, "ALZWebhookServiceUri": { - "value": "" + "value": [] }, "ALZFunctionResourceId": { "value": "" @@ -92,7 +121,7 @@ "value": "" }, "BYOActionGroup": { - "value": "" + "value": [] }, "BYOAlertProcessingRule": { "value": "" @@ -736,15 +765,27 @@ "FirewallHealthThreshold": { "value": "90" }, + "activityFWDeletePolicyEffect": { + "value": "deployIfNotExists" + }, "activityFWDeleteAlertState": { "value": "true" }, + "activityNSGDeletePolicyEffect": { + "value": "deployIfNotExists" + }, "activityNSGDeleteAlertState": { "value": "true" }, + "activityUDRUpdatePolicyEffect": { + "value": "deployIfNotExists" + }, "activityUDRUpdateAlertState": { "value": "true" }, + "activityVPNGWDeletePolicyEffect": { + "value": "deployIfNotExists" + }, "activityVPNGWDeleteAlertState": { "value": "true" }, @@ -988,694 +1029,852 @@ }, "activityKVDeleteAlertState": { "value": "true" - } - } - }, - "policyAssignmentParametersLandingZone": { - "value": { - "KVRequestAlertSeverity": { - "value": "2" - }, - "KVRequestWindowSize": { - "value": "PT5M" }, - "KVRequestEvaluationFrequency": { - "value": "PT5M" - }, - "KVRequestPolicyEffect": { - "value": "disabled" - }, - "KVRequestAlertState": { - "value": "true" + "activityKVDeletePolicyEffect": { + "value": "deployIfNotExists" }, - "KvAvailabilityAlertSeverity": { + "HSMsAvailabilityAlertSeverity": { "value": "1" }, - "KvAvailabilityWindowSize": { + "HSMsAvailabilityWindowSize": { "value": "PT1M" }, - "KvAvailabilityEvaluationFrequency": { + "HSMsAvailabilityEvaluationFrequency": { "value": "PT1M" }, - "KvAvailabilityPolicyEffect": { + "HSMsAvailabilityPolicyEffect": { "value": "disabled" }, - "KvAvailabilityAlertState": { + "HSMsAvailabilityAlertState": { "value": "true" }, - "KVAvailabilityThreshold": { + "HSMsAvailabilityThreshold": { "value": "20" }, - "KvLatencyAvailabilityAlertSeverity": { + "HSMsLatencyAvailabilityAlertSeverity": { "value": "3" }, - "KvLatencyAvailabilityWindowSize": { + "HSMsLatencyAvailabilityWindowSize": { "value": "PT5M" }, - "KvLatencyAvailabilityEvaluationFrequency": { + "HSMsLatencyAvailabilityEvaluationFrequency": { "value": "PT5M" }, - "KvLatencyAvailabilityPolicyEffect": { + "HSMsLatencyAvailabilityPolicyEffect": { "value": "disabled" }, - "KvLatencyAvailabilityAlertState": { + "HSMsLatencyAvailabilityAlertState": { "value": "true" }, - "KvLatencyAvailabilityThreshold": { + "HSMsLatencyAvailabilityThreshold": { "value": "1000" }, - "KVCapacityAlertSeverity": { - "value": "1" - }, - "KVCapacityWindowSize": { - "value": "PT5M" - }, - "KVCapacityEvaluationFrequency": { - "value": "PT1M" - }, - "KVCapacityPolicyEffect": { - "value": "disabled" - }, - "KVCapacityAlertState": { - "value": "true" - }, - "KVCapacityThreshold": { - "value": "75" - }, - "activityKVDeleteAlertState": { + "activityHSMsDeleteAlertState": { "value": "true" }, - "StorageAccountAvailabilityAlertSeverity": { + "activityHSMsDeletePolicyEffect": { + "value": "deployIfNotExists" + } + } + }, + "policyAssignmentParametersHybridVM": { + "value": { + "HybridVMHeartBeatRGAlertSeverity": { "value": "1" }, - "StorageAccountAvailabilityWindowSize": { - "value": "PT5M" + "HybridVMHeartBeatRGWindowSize": { + "value": "PT6H" }, - "StorageAccountAvailabilityFrequency": { + "HybridVMHeartBeatRGEvaluationFrequency": { "value": "PT5M" }, - "StorageAccountAvailabilityPolicyEffect": { - "value": "deployIfNotExists" + "HybridVMHeartBeatRGAutoMitigate": { + "value": "true" }, - "StorageAccountAvailabilityAlertState": { + "HybridVMHeartBeatRGAutoResolve": { "value": "true" }, - "StorageAccountAvailabilityThreshold": { - "value": "90" + "HybridVMHeartBeatRGAutoResolveTime": { + "value": "00:10:00" }, - "StorageAccountDeletePolicyEffect": { + "HybridVMHeartBeatRGPolicyEffect": { "value": "deployIfNotExists" }, - "StorageAccountDeleteAlertState": { + "HybridVMHeartBeatRGAlertState": { "value": "true" }, - "PIPDDoSAttackAlertSeverity": { - "value": "1" - }, - "PIPDDoSAttackWindowSize": { - "value": "PT5M" - }, - "PIPDDoSAttackEvaluationFrequency": { - "value": "PT5M" + "HybridVMHeartBeatRGThreshold": { + "value": "10" }, - "PIPDDoSAttackPolicyEffect": { - "value": "deployIfNotExists" + "HybridVMHeartBeatRGOperator": { + "value": "GreaterThan" }, - "PIPDDoSAttackAlertState": { - "value": "true" + "HybridVMHeartBeatRGTimeAggregation": { + "value": "Count" }, - "PIPDDoSAttackThreshold": { - "value": "0" + "HybridVMHeartBeatRGFailingPeriods": { + "value": "1" }, - "PIPPacketsInDDoSAlertSeverity": { - "value": "4" + "HybridVMNetworkInAlertSeverity": { + "value": "2" }, - "PIPPacketsInDDoSWindowSize": { - "value": "PT5M" + "HybridVMNetworkInWindowSize": { + "value": "PT15M" }, - "PIPPacketsInDDoSEvaluationFrequency": { + "HybridVMNetworkInEvaluationFrequency": { "value": "PT5M" }, - "PIPPacketsInDDoSPolicyEffect": { - "value": "disabled" + "HybridVMNetworkInAutoMitigate": { + "value": "true" }, - "PIPPacketsInDDoSAlertState": { + "HybridVMNetworkInAutoResolve": { "value": "true" }, - "PIPPacketsInDDoSThreshold": { - "value": "40000" + "HybridVMNetworkInAutoResolveTime": { + "value": "00:10:00" }, - "PIPVIPAvailabilityAlertSeverity": { - "value": "1" + "HybridVMNetworkInPolicyEffect": { + "value": "deployIfNotExists" }, - "PIPVIPAvailabilityWindowSize": { - "value": "PT5M" + "HybridVMNetworkInAlertState": { + "value": "true" }, - "PIPVIPAvailabilityEvaluationFrequency": { - "value": "PT1M" + "HybridVMNetworkInThreshold": { + "value": "10000000" }, - "PIPVIPAvailabilityPolicyEffect": { - "value": "deployIfNotExists" + "HybridVMNetworkInOperator": { + "value": "GreaterThan" }, - "PIPVIPAvailabilityAlertState": { - "value": "true" + "HybridVMNetworkInTimeAggregation": { + "value": "Count" }, - "PIPVIPAvailabilityThreshold": { + "HybridVMNetworkInEvaluationPeriods": { "value": "1" }, - "PIPBytesInDDoSAlertSeverity": { - "value": "4" + "HybridVMNetworkInFailingPeriods": { + "value": "1" }, - "PIPBytesInDDoSWindowSize": { - "value": "PT5M" + "HybridVMNetworkInComputersToInclude": { + "value": [ + "*" + ] }, - "PIPBytesInDDoSEvaluationFrequency": { - "value": "PT5M" + "HybridVMNetworkOutAlertSeverity": { + "value": "2" }, - "PIPBytesInDDoSPolicyEffect": { - "value": "disabled" + "HybridVMNetworkOutWindowSize": { + "value": "PT15M" }, - "PIPBytesInDDoSAlertState": { + "HybridVMNetworkOutEvaluationFrequency": { + "value": "PT5M" + }, + "HybridVMNetworkOutAutoMitigate": { "value": "true" }, - "PIPBytesInDDoSThreshold": { - "value": "8000000" + "HybridVMNetworkOutAutoResolve": { + "value": "true" }, - "RVBackupHealthMonitorPolicyEffect": { - "value": "modify" + "HybridVMNetworkOutAutoResolveTime": { + "value": "00:10:00" }, - "VNETDDOSAttackAlertSeverity": { - "value": "1" + "HybridVMNetworkOutPolicyEffect": { + "value": "deployIfNotExists" }, - "VNETDDOSAttackWindowSize": { - "value": "PT5M" + "HybridVMNetworkOutAlertState": { + "value": "true" }, - "VNETDDOSAttackEvaluationFrequency": { - "value": "PT1M" + "HybridVMNetworkOutThreshold": { + "value": "10000000" }, - "VNETDDOSAttackPolicyEffect": { - "value": "deployIfNotExists" + "HybridVMNetworkOutOperator": { + "value": "GreaterThan" }, - "VNETDDOSAttackAlertState": { - "value": "true" + "HybridVMNetworkOutTimeAggregation": { + "value": "Count" }, - "VNETDDOSAttackThreshold": { + "HybridVMNetworkOutEvaluationPeriods": { "value": "1" }, - "activityNSGDeleteAlertState": { - "value": "true" + "HybridVMNetworkOutFailingPeriods": { + "value": "1" }, - "activityUDRUpdateAlertState": { - "value": "true" + "HybridVMNetworkOutComputersToInclude": { + "value": [ + "*" + ] }, - "VMHeartBeatRGAlertSeverity": { - "value": "1" + "HybridVMOSDiskReadLatencyAlertSeverity": { + "value": "2" }, - "VMHeartBeatRGWindowSize": { + "HybridVMOSDiskReadLatencyWindowSize": { "value": "PT15M" }, - "VMHeartBeatRGEvaluationFrequency": { + "HybridVMOSDiskReadLatencyEvaluationFrequency": { "value": "PT5M" }, - "VMHeartBeatRGAutoMitigate": { + "HybridVMOSDiskReadLatencyAutoMitigate": { "value": "true" }, - "VMHeartBeatRGAutoResolve": { + "HybridVMOSDiskReadLatencyAutoResolve": { "value": "true" }, - "VMHeartBeatRGAutoResolveTime": { + "HybridVMOSDiskReadLatencyAutoResolveTime": { "value": "00:10:00" }, - "VMHeartBeatRGPolicyEffect": { + "HybridVMOSDiskReadLatencyPolicyEffect": { "value": "deployIfNotExists" }, - "VMHeartBeatRGAlertState": { + "HybridVMOSDiskReadLatencyAlertState": { "value": "true" }, - "VMHeartBeatRGThreshold": { - "value": "10" + "HybridVMOSDiskReadLatencyThreshold": { + "value": "30" }, - "VMHeartBeatRGOperator": { + "HybridVMOSDiskReadLatencyOperator": { "value": "GreaterThan" }, - "VMHeartBeatRGTimeAggregation": { - "value": "Average" + "HybridVMOSDiskReadLatencyTimeAggregation": { + "value": "Count" }, - "VMNetworkInAlertSeverity": { + "HybridVMOSDiskReadLatencyEvaluationPeriods": { + "value": "1" + }, + "HybridVMOSDiskReadLatencyFailingPeriods": { + "value": "1" + }, + "HybridVMOSDiskReadLatencyComputersToInclude": { + "value": [ + "*" + ] + }, + "HybridVMOSDiskWriteLatencyAlertSeverity": { "value": "2" }, - "VMNetworkInWindowSize": { + "HybridVMOSDiskWriteLatencyWindowSize": { "value": "PT15M" }, - "VMNetworkInEvaluationFrequency": { + "HybridVMOSDiskWriteLatencyEvaluationFrequency": { "value": "PT5M" }, - "VMNetworkInAutoMitigate": { + "HybridVMOSDiskWriteLatencyAutoMitigate": { "value": "true" }, - "VMNetworkInAutoResolve": { + "HybridVMOSDiskWriteLatencyAutoResolve": { "value": "true" }, - "VMNetworkInAutoResolveTime": { + "HybridVMOSDiskWriteLatencyAutoResolveTime": { "value": "00:10:00" }, - "VMNetworkInPolicyEffect": { + "HybridVMOSDiskWriteLatencyPolicyEffect": { "value": "deployIfNotExists" }, - "VMNetworkInAlertState": { + "HybridVMOSDiskWriteLatencyAlertState": { "value": "true" }, - "VMNetworkInThreshold": { - "value": "10000000" + "HybridVMOSDiskWriteLatencyThreshold": { + "value": "30" }, - "VMNetworkInOperator": { + "HybridVMOSDiskWriteLatencyOperator": { "value": "GreaterThan" }, - "VMNetworkInTimeAggregation": { - "value": "Average" + "HybridVMOSDiskWriteLatencyTimeAggregation": { + "value": "Count" }, - "VMNetworkInEvaluationPeriods": { + "HybridVMOSDiskWriteLatencyEvaluationPeriods": { "value": "1" }, - "VMNetworkInFailingPeriods": { + "HybridVMOSDiskWriteLatencyFailingPeriods": { "value": "1" }, - "VMNetworkInComputersToInclude": { - "value": [ - "*" - ] - }, - "VMNetworkInNetworkInterfaceToInclude": { + "HybridVMOSDiskWriteLatencyComputersToInclude": { "value": [ "*" ] }, - "VMNetworkOutAlertSeverity": { + "HybridVMOSDiskSpaceAlertSeverity": { "value": "2" }, - "VMNetworkOutWindowSize": { + "HybridVMOSDiskSpaceWindowSize": { "value": "PT15M" }, - "VMNetworkOutEvaluationFrequency": { + "HybridVMOSDiskSpaceEvaluationFrequency": { "value": "PT5M" }, - "VMNetworkOutAutoMitigate": { + "HybridVMOSDiskSpaceAutoMitigate": { "value": "true" }, - "VMNetworkOutAutoResolve": { + "HybridVMOSDiskSpaceAutoResolve": { "value": "true" }, - "VMNetworkOutAutoResolveTime": { + "HybridVMOSDiskSpaceAutoResolveTime": { "value": "00:10:00" }, - "VMNetworkOutPolicyEffect": { + "HybridVMOSDiskSpacePolicyEffect": { "value": "deployIfNotExists" }, - "VMNetworkOutAlertState": { + "HybridVMOSDiskSpaceAlertState": { "value": "true" }, - "VMNetworkOutThreshold": { - "value": "10000000" + "HybridVMOSDiskSpaceThreshold": { + "value": "10" }, - "VMNetworkOutOperator": { + "HybridVMOSDiskSpaceOperator": { "value": "GreaterThan" }, - "VMNetworkOutTimeAggregation": { - "value": "Average" + "HybridVMOSDiskSpaceTimeAggregation": { + "value": "Count" }, - "VMNetworkOutEvaluationPeriods": { + "HybridVMOSDiskSpaceEvaluationPeriods": { "value": "1" }, - "VMNetworkOutFailingPeriods": { + "HybridVMOSDiskSpaceFailingPeriods": { "value": "1" }, - "VMNetworkOutComputersToInclude": { - "value": [ - "*" - ] - }, - "VMNetworkOutNetworkInterfaceToInclude": { + "HybridVMOSDiskSpaceComputersToInclude": { "value": [ "*" ] }, - "VMOSDiskReadLatencyAlertSeverity": { + "HybridVMPercentCPUAlertSeverity": { "value": "2" }, - "VMOSDiskReadLatencyWindowSize": { + "HybridVMPercentCPUWindowSize": { "value": "PT15M" }, - "VMOSDiskReadLatencyEvaluationFrequency": { + "HybridVMPercentCPUEvaluationFrequency": { "value": "PT5M" }, - "VMOSDiskReadLatencyAutoMitigate": { + "HybridVMPercentCPUAutoMitigate": { "value": "true" }, - "VMOSDiskReadLatencyAutoResolve": { + "HybridVMPercentCPUAutoResolve": { "value": "true" }, - "VMOSDiskReadLatencyAutoResolveTime": { + "HybridVMPercentCPUAutoResolveTime": { "value": "00:10:00" }, - "VMOSDiskReadLatencyPolicyEffect": { + "HybridVMPercentCPUPolicyEffect": { "value": "deployIfNotExists" }, - "VMOSDiskReadLatencyAlertState": { + "HybridVMPercentCPUAlertState": { "value": "true" }, - "VMOSDiskReadLatencyThreshold": { - "value": "30" + "HybridVMPercentCPUThreshold": { + "value": "85" }, - "VMOSDiskReadLatencyOperator": { + "HybridVMPercentCPUOperator": { "value": "GreaterThan" }, - "VMOSDiskReadLatencyTimeAggregation": { - "value": "Average" + "HybridVMPercentCPUTimeAggregation": { + "value": "Count" }, - "VMOSDiskReadLatencyEvaluationPeriods": { + "HybridVMPercentMemoryAlertSeverity": { + "value": "2" + }, + "HybridVMPercentCPUFailingPeriods": { "value": "1" }, - "VMOSDiskReadLatencyFailingPeriods": { + "HybridVMPercentMemoryWindowSize": { + "value": "PT15M" + }, + "HybridVMPercentMemoryEvaluationFrequency": { + "value": "PT5M" + }, + "HybridVMPercentMemoryAutoMitigate": { + "value": "true" + }, + "HybridVMPercentMemoryAutoResolve": { + "value": "true" + }, + "HybridVMPercentMemoryAutoResolveTime": { + "value": "00:10:00" + }, + "HybridVMPercentMemoryPolicyEffect": { + "value": "deployIfNotExists" + }, + "HybridVMPercentMemoryAlertState": { + "value": "true" + }, + "HybridVMPercentMemoryThreshold": { + "value": "10" + }, + "HybridVMPercentMemoryOperator": { + "value": "GreaterThan" + }, + "HybridVMPercentMemoryTimeAggregation": { + "value": "Count" + }, + "HybridVMPercentMemoryFailingPeriods": { "value": "1" }, - "VMOSDiskReadLatencyComputersToInclude": { - "value": [ - "*" - ] + "HybridVMDataDiskSpaceAlertSeverity": { + "value": "2" }, - "VMOSDiskReadLatencyDisksToInclude": { - "value": [ - "C:", - "/" - ] + "HybridVMDataDiskSpaceWindowSize": { + "value": "PT15M" }, - "VMOSDiskWriteLatencyAlertSeverity": { + "HybridVMDataDiskSpaceEvaluationFrequency": { + "value": "PT5M" + }, + "HybridVMDataDiskSpaceAutoMitigate": { + "value": "true" + }, + "HybridVMDataDiskSpaceAutoResolve": { + "value": "true" + }, + "HybridVMDataDiskSpaceAutoResolveTime": { + "value": "00:10:00" + }, + "HybridVMDataDiskSpacePolicyEffect": { + "value": "deployIfNotExists" + }, + "HybridVMDataDiskSpaceAlertState": { + "value": "true" + }, + "HybridVMDataDiskSpaceThreshold": { + "value": "10" + }, + "HybridVMDataDiskSpaceOperator": { + "value": "GreaterThan" + }, + "HybridVMDataDiskSpaceTimeAggregation": { + "value": "Count" + }, + "HybridVMDataDiskSpaceEvaluationPeriods": { + "value": "1" + }, + "HybridVMDataDiskSpaceFailingPeriods": { + "value": "1" + }, + "HybridVMDataDiskReadLatencyAlertSeverity": { "value": "2" }, - "VMOSDiskWriteLatencyWindowSize": { + "HybridVMDataDiskReadLatencyWindowSize": { "value": "PT15M" }, - "VMOSDiskWriteLatencyEvaluationFrequency": { + "HybridVMDataDiskReadLatencyEvaluationFrequency": { "value": "PT5M" }, - "VMOSDiskWriteLatencyAutoMitigate": { + "HybridVMDataDiskReadLatencyAutoMitigate": { "value": "true" }, - "VMOSDiskWriteLatencyAutoResolve": { + "HybridVMDataDiskReadLatencyAutoResolve": { "value": "true" }, - "VMOSDiskWriteLatencyAutoResolveTime": { + "HybridVMDataDiskReadLatencyAutoResolveTime": { "value": "00:10:00" }, - "VMOSDiskWriteLatencyPolicyEffect": { + "HybridVMDataDiskReadLatencyPolicyEffect": { "value": "deployIfNotExists" }, - "VMOSDiskWriteLatencyAlertState": { + "HybridVMDataDiskReadLatencyAlertState": { "value": "true" }, - "VMOSDiskWriteLatencyThreshold": { - "value": "50" + "HybridVMDataDiskReadLatencyThreshold": { + "value": "30" }, - "VMOSDiskWriteLatencyOperator": { + "HybridVMDataDiskReadLatencyOperator": { "value": "GreaterThan" }, - "VMOSDiskWriteLatencyTimeAggregation": { - "value": "Average" + "HybridVMDataDiskReadLatencyTimeAggregation": { + "value": "Count" }, - "VMOSDiskWriteLatencyEvaluationPeriods": { + "HybridVMDataDiskReadLatencyEvaluationPeriods": { "value": "1" }, - "VMOSDiskWriteLatencyFailingPeriods": { + "HybridVMDataDiskReadLatencyFailingPeriods": { "value": "1" }, - "VMOSDiskWriteLatencyComputersToInclude": { + "HybridVMDataDiskReadLatencyComputersToInclude": { "value": [ "*" ] }, - "VMOSDiskWriteLatencyDisksToInclude": { - "value": [ - "C:", - "/" - ] - }, - "VMOSDiskSpaceAlertSeverity": { + "HybridVMDataDiskWriteLatencyAlertSeverity": { "value": "2" }, - "VMOSDiskSpaceWindowSize": { + "HybridVMDataDiskWriteLatencyWindowSize": { "value": "PT15M" }, - "VMOSDiskSpaceEvaluationFrequency": { + "HybridVMDataDiskWriteLatencyEvaluationFrequency": { "value": "PT5M" }, - "VMOSDiskSpaceAutoMitigate": { + "HybridVMDataDiskWriteLatencyAutoMitigate": { "value": "true" }, - "VMOSDiskSpaceAutoResolve": { + "HybridVMDataDiskWriteLatencyAutoResolve": { "value": "true" }, - "VMOSDiskSpaceAutoResolveTime": { + "HybridVMDataDiskWriteLatencyAutoResolveTime": { "value": "00:10:00" }, - "VMOSDiskSpacePolicyEffect": { + "HybridVMDataDiskWriteLatencyPolicyEffect": { "value": "deployIfNotExists" }, - "VMOSDiskSpaceAlertState": { + "HybridVMDataDiskWriteLatencyAlertState": { "value": "true" }, - "VMOSDiskSpaceThreshold": { - "value": "10" + "HybridVMDataDiskWriteLatencyThreshold": { + "value": "30" }, - "VMOSDiskSpaceOperator": { - "value": "LessThan" + "HybridVMDataDiskWriteLatencyOperator": { + "value": "GreaterThan" }, - "VMOSDiskSpaceTimeAggregation": { - "value": "Average" + "HybridVMDataDiskWriteLatencyTimeAggregation": { + "value": "Count" }, - "VMOSDiskSpaceEvaluationPeriods": { + "HybridVMDataDiskWriteLatencyEvaluationPeriods": { "value": "1" }, - "VMOSDiskSpaceFailingPeriods": { + "HybridVMDataDiskWriteLatencyFailingPeriods": { "value": "1" }, - "VMOSDiskSpaceComputersToInclude": { + "HybridVMDataDiskWriteLatencyComputersToInclude": { "value": [ "*" ] }, - "VMOSDiskSpaceDisksToInclude": { - "value": [ - "C:", - "/" - ] + "HybridVMDisconnectedAlertSeverity": { + "value": "1" }, - "VMPercentCPUAlertSeverity": { + "HybridVMDisconnectedAlertWindowSize": { + "value": "P1D" + }, + "HybridVMDisconnectedAlertEvaluationFrequency": { + "value": "PT10M" + }, + "HybridVMDisconnectedAlertAutoMitigate": { + "value": "false" + }, + "HybridVMDisconnectedAlertPolicyEffect": { + "value": "deployIfNotExists" + }, + "HybridVMDisconnectedAlertState": { + "value": "true" + }, + "HybridVMDisconnectedAlertThreshold": { + "value": "10m" + }, + "HybridVMDisconnectedAlertOperator": { + "value": "GreaterThan" + }, + "HybridVMDisconnectedAlertTimeAggregation": { + "value": "Count" + }, + "HybridVMDisconnectedAlertEvaluationPeriods": { + "value": "1" + }, + "HybridVMDisconnectedAlertFailingPeriods": { + "value": "1" + } + } + }, + "policyAssignmentParametersManagement": { + "value": { + "AATotalJobAlertSeverity": { "value": "2" }, - "VMPercentCPUWindowSize": { - "value": "PT15M" + "AATotalJobAlertWindowSize": { + "value": "PT5M" }, - "VMPercentCPUEvaluationFrequency": { + "AATotalJobAlertEvaluationFrequency": { + "value": "PT1M" + }, + "AATotalJobAlertPolicyEffect": { + "value": "deployIfNotExists" + }, + "AATotalJobAlertAlertState": { + "value": "true" + }, + "AATotalJobAlertThreshold": { + "value": "20" + }, + "RVBackupHealthMonitorPolicyEffect": { + "value": "modify" + }, + "StorageAccountAvailabilityAlertSeverity": { + "value": "1" + }, + "StorageAccountAvailabilityWindowSize": { "value": "PT5M" }, - "VMPercentCPUAutoMitigate": { + "StorageAccountAvailabilityFrequency": { + "value": "PT5M" + }, + "StorageAccountAvailabilityPolicyEffect": { + "value": "deployIfNotExists" + }, + "StorageAccountAvailabilityAlertState": { "value": "true" }, - "VMPercentCPUAutoResolve": { + "StorageAccountAvailabilityThreshold": { + "value": "90" + }, + "StorageAccountDeletePolicyEffect": { + "value": "deployIfNotExists" + }, + "StorageAccountDeleteAlertState": { "value": "true" }, - "VMPercentCPUAutoResolveTime": { - "value": "00:10:00" + "activityLAWDeletePolicyEffect": { + "value": "deployIfNotExists" }, - "VMPercentCPUPolicyEffect": { + "activityLAWDeleteAlertState": { + "value": "true" + }, + "activityLAWKeyRegenPolicyEffect": { "value": "deployIfNotExists" }, - "VMPercentCPUAlertState": { + "activityLAWKeyRegenAlertState": { "value": "true" }, - "VMPercentCPUThreshold": { - "value": "85" + "LAWDailyCapLimitSeverity": { + "value": "1" }, - "VMPercentCPUOperator": { + "LAWDailyCapLimitOperator": { "value": "GreaterThan" }, - "VMPercentCPUTimeAggregation": { - "value": "Average" + "LAWDailyCapLimitTimeAggregation": { + "value": "Count" + }, + "LAWDailyCapLimitWindowSize": { + "value": "PT5M" + }, + "LAWDailyCapLimitEvaluationFrequency": { + "value": "PT5M" + }, + "LAWDailyCapLimitAutoMitigate": { + "value": "true" + }, + "LAWDailyCapLimitThreshold": { + "value": "0" + }, + "LAWDailyCapLimitFailingPeriods": { + "value": "1" + }, + "LAWDailyCapLimitEvaluationPeriods": { + "value": "1" + }, + "LAWDailyCapLimitPolicyEffect": { + "value": "deployIfNotExists" + }, + "LAWDailyCapLimitAlertState": { + "value": "true" + } + } + }, + "policyAssignmentParametersKeyManagement": { + "value": { + "KVRequestAlertSeverity": { + "value": "2" + }, + "KVRequestWindowSize": { + "value": "PT5M" + }, + "KVRequestEvaluationFrequency": { + "value": "PT5M" + }, + "KVRequestPolicyEffect": { + "value": "disabled" + }, + "KVRequestAlertState": { + "value": "true" + }, + "KvAvailabilityAlertSeverity": { + "value": "1" + }, + "KvAvailabilityWindowSize": { + "value": "PT1M" + }, + "KvAvailabilityEvaluationFrequency": { + "value": "PT1M" + }, + "KvAvailabilityPolicyEffect": { + "value": "disabled" + }, + "KvAvailabilityAlertState": { + "value": "true" + }, + "KVAvailabilityThreshold": { + "value": "20" + }, + "KvLatencyAvailabilityAlertSeverity": { + "value": "3" + }, + "KvLatencyAvailabilityWindowSize": { + "value": "PT5M" + }, + "KvLatencyAvailabilityEvaluationFrequency": { + "value": "PT5M" + }, + "KvLatencyAvailabilityPolicyEffect": { + "value": "disabled" + }, + "KvLatencyAvailabilityAlertState": { + "value": "true" }, - "VMPercentMemoryAlertSeverity": { - "value": "2" + "KvLatencyAvailabilityThreshold": { + "value": "1000" }, - "VMPercentMemoryWindowSize": { - "value": "PT15M" + "KVCapacityAlertSeverity": { + "value": "1" }, - "VMPercentMemoryEvaluationFrequency": { + "KVCapacityWindowSize": { "value": "PT5M" }, - "VMPercentMemoryAutoMitigate": { - "value": "true" + "KVCapacityEvaluationFrequency": { + "value": "PT1M" }, - "VMPercentMemoryAutoResolve": { - "value": "true" + "KVCapacityPolicyEffect": { + "value": "disabled" }, - "VMPercentMemoryAutoResolveTime": { - "value": "00:10:00" + "KVCapacityAlertState": { + "value": "true" }, - "VMPercentMemoryPolicyEffect": { - "value": "deployIfNotExists" + "KVCapacityThreshold": { + "value": "75" }, - "VMPercentMemoryAlertState": { + "activityKVDeleteAlertState": { "value": "true" }, - "VMPercentMemoryThreshold": { - "value": "10" - }, - "VMPercentMemoryOperator": { - "value": "LessThan" + "activityKVDeletePolicyEffect": { + "value": "deployIfNotExists" }, - "VMPercentMemoryTimeAggregation": { - "value": "Average" + "HSMsAvailabilityAlertSeverity": { + "value": "1" }, - "VMDataDiskSpaceAlertSeverity": { - "value": "2" + "HSMsAvailabilityWindowSize": { + "value": "PT1M" }, - "VMDataDiskSpaceWindowSize": { - "value": "PT15M" + "HSMsAvailabilityEvaluationFrequency": { + "value": "PT1M" }, - "VMDataDiskSpaceEvaluationFrequency": { - "value": "PT5M" + "HSMsAvailabilityPolicyEffect": { + "value": "disabled" }, - "VMDataDiskSpaceAutoMitigate": { + "HSMsAvailabilityAlertState": { "value": "true" }, - "VMDataDiskSpaceAutoResolve": { - "value": "true" + "HSMsAvailabilityThreshold": { + "value": "20" }, - "VMDataDiskSpaceAutoResolveTime": { - "value": "00:10:00" + "HSMsLatencyAvailabilityAlertSeverity": { + "value": "3" }, - "VMDataDiskSpacePolicyEffect": { - "value": "deployIfNotExists" + "HSMsLatencyAvailabilityWindowSize": { + "value": "PT5M" }, - "VMDataDiskSpaceAlertState": { - "value": "true" + "HSMsLatencyAvailabilityEvaluationFrequency": { + "value": "PT5M" }, - "VMDataDiskSpaceThreshold": { - "value": "10" + "HSMsLatencyAvailabilityPolicyEffect": { + "value": "disabled" }, - "VMDataDiskSpaceOperator": { - "value": "LessThan" + "HSMsLatencyAvailabilityAlertState": { + "value": "true" }, - "VMDataDiskSpaceTimeAggregation": { - "value": "Average" + "HSMsLatencyAvailabilityThreshold": { + "value": "1000" }, - "VMDataDiskSpaceEvaluationPeriods": { - "value": "1" + "activityHSMsDeleteAlertState": { + "value": "true" }, - "VMDataDiskSpaceFailingPeriods": { + "activityHSMsDeletePolicyEffect": { + "value": "deployIfNotExists" + } + } + }, + "policyAssignmentParametersLoadBalancing": { + "value": { + "PIPDDoSAttackAlertSeverity": { "value": "1" }, - "VMDataDiskSpaceDisksToInclude": { - "value": [ - "*" - ] - }, - "VMDataDiskReadLatencyAlertSeverity": { - "value": "2" - }, - "VMDataDiskReadLatencyWindowSize": { - "value": "PT15M" + "PIPDDoSAttackWindowSize": { + "value": "PT5M" }, - "VMDataDiskReadLatencyEvaluationFrequency": { + "PIPDDoSAttackEvaluationFrequency": { "value": "PT5M" }, - "VMDataDiskReadLatencyAutoMitigate": { - "value": "true" + "PIPDDoSAttackPolicyEffect": { + "value": "deployIfNotExists" }, - "VMDataDiskReadLatencyAutoResolve": { + "PIPDDoSAttackAlertState": { "value": "true" }, - "VMDataDiskReadLatencyAutoResolveTime": { - "value": "00:10:00" + "PIPDDoSAttackThreshold": { + "value": "0" }, - "VMDataDiskReadLatencyPolicyEffect": { - "value": "deployIfNotExists" + "PIPPacketsInDDoSAlertSeverity": { + "value": "4" }, - "VMDataDiskReadLatencyAlertState": { - "value": "true" + "PIPPacketsInDDoSWindowSize": { + "value": "PT5M" }, - "VMDataDiskReadLatencyThreshold": { - "value": "30" + "PIPPacketsInDDoSEvaluationFrequency": { + "value": "PT5M" }, - "VMDataDiskReadLatencyOperator": { - "value": "GreaterThan" + "PIPPacketsInDDoSPolicyEffect": { + "value": "disabled" }, - "VMDataDiskReadLatencyTimeAggregation": { - "value": "Average" + "PIPPacketsInDDoSAlertState": { + "value": "true" }, - "VMDataDiskReadLatencyEvaluationPeriods": { - "value": "1" + "PIPPacketsInDDoSThreshold": { + "value": "40000" }, - "VMDataDiskReadLatencyFailingPeriods": { + "PIPVIPAvailabilityAlertSeverity": { "value": "1" }, - "VMDataDiskReadLatencyComputersToInclude": { - "value": [ - "*" - ] + "PIPVIPAvailabilityWindowSize": { + "value": "PT5M" }, - "VMDataDiskReadLatencyDisksToInclude": { - "value": [ - "*" - ] + "PIPVIPAvailabilityEvaluationFrequency": { + "value": "PT1M" }, - "VMDataDiskWriteLatencyAlertSeverity": { - "value": "2" + "PIPVIPAvailabilityPolicyEffect": { + "value": "deployIfNotExists" }, - "VMDataDiskWriteLatencyWindowSize": { - "value": "PT15M" + "PIPVIPAvailabilityAlertState": { + "value": "true" }, - "VMDataDiskWriteLatencyEvaluationFrequency": { - "value": "PT5M" + "PIPVIPAvailabilityThreshold": { + "value": "1" }, - "VMDataDiskWriteLatencyAutoMitigate": { - "value": "true" + "PIPBytesInDDoSAlertSeverity": { + "value": "4" }, - "VMDataDiskWriteLatencyAutoResolve": { - "value": "true" + "PIPBytesInDDoSWindowSize": { + "value": "PT5M" }, - "VMDataDiskWriteLatencyAutoResolveTime": { - "value": "00:10:00" + "PIPBytesInDDoSEvaluationFrequency": { + "value": "PT5M" }, - "VMDataDiskWriteLatencyPolicyEffect": { - "value": "deployIfNotExists" + "PIPBytesInDDoSPolicyEffect": { + "value": "disabled" }, - "VMDataDiskWriteLatencyAlertState": { + "PIPBytesInDDoSAlertState": { "value": "true" }, - "VMDataDiskWriteLatencyThreshold": { - "value": "30" + "PIPBytesInDDoSThreshold": { + "value": "8000000" }, - "VMDataDiskWriteLatencyOperator": { - "value": "GreaterThan" + "VNETDDOSAttackAlertSeverity": { + "value": "1" }, - "VMDataDiskWriteLatencyTimeAggregation": { - "value": "Average" + "VNETDDOSAttackWindowSize": { + "value": "PT5M" }, - "VMDataDiskWriteLatencyEvaluationPeriods": { - "value": "1" + "VNETDDOSAttackEvaluationFrequency": { + "value": "PT1M" }, - "VMDataDiskWriteLatencyFailingPeriods": { - "value": "1" + "VNETDDOSAttackPolicyEffect": { + "value": "deployIfNotExists" }, - "VMDataDiskWriteLatencyComputersToInclude": { - "value": [ - "*" - ] + "VNETDDOSAttackAlertState": { + "value": "true" }, - "VMDataDiskWriteLatencyDisksToInclude": { - "value": [ - "*" - ] + "VNETDDOSAttackThreshold": { + "value": "1" }, "AGWApplicationGatewayTotalTimeAlertSeverity": { "value": "2" @@ -1836,112 +2035,52 @@ "LBGlobalBackendAvailabilityPolicyEffect": { "value": "deployIfNotExists" }, - "LBGlobalBackendAvailabilityAlertState": { - "value": "true" - }, - "LBHealthProbeStatusAlertSeverity": { - "value": "2" - }, - "LBHealthProbeStatusWindowSize": { - "value": "PT5M" - }, - "LBHealthProbeStatusEvaluationFrequency": { - "value": "PT1M" - }, - "LBHealthProbeStatusPolicyEffect": { - "value": "deployIfNotExists" - }, - "LBHealthProbeStatusAlertState": { - "value": "true" - }, - "LBUsedSNATPortsAlertSeverity": { - "value": "1" - }, - "LBUsedSNATPortsWindowSize": { - "value": "PT5M" - }, - "LBUsedSNATPortsEvaluationFrequency": { - "value": "PT1M" - }, - "LBUsedSNATPortsPolicyEffect": { - "value": "deployIfNotExists" - }, - "LBUsedSNATPortsAlertState": { - "value": "true" - }, - "TMEndpointHealthAlertSeverity": { - "value": "2" - }, - "TMEndpointHealthWindowSize": { - "value": "PT5M" - }, - "TMEndpointHealthEvaluationFrequency": { - "value": "PT1M" - }, - "TMEndpointHealthPolicyEffect": { - "value": "deployIfNotExists" - }, - "TMEndpointHealthAlertState": { - "value": "true" - }, - "WSFCPUPercentageAlertSeverity": { - "value": "2" - }, - "WSFCPUPercentageWindowSize": { - "value": "PT5M" - }, - "WSFCPUPercentageEvaluationFrequency": { - "value": "PT1M" - }, - "WSFCPUPercentagePolicyEffect": { - "value": "deployIfNotExists" - }, - "WSFCPUPercentageAlertState": { + "LBGlobalBackendAvailabilityAlertState": { "value": "true" }, - "WSFMemoryPercentageAlertSeverity": { + "LBHealthProbeStatusAlertSeverity": { "value": "2" }, - "WSFMemoryPercentageWindowSize": { + "LBHealthProbeStatusWindowSize": { "value": "PT5M" }, - "WSFMemoryPercentageEvaluationFrequency": { + "LBHealthProbeStatusEvaluationFrequency": { "value": "PT1M" }, - "WSFMemoryPercentagePolicyEffect": { + "LBHealthProbeStatusPolicyEffect": { "value": "deployIfNotExists" }, - "WSFMemoryPercentageAlertState": { + "LBHealthProbeStatusAlertState": { "value": "true" }, - "WSFDiskQueueLengthAlertSeverity": { - "value": "2" + "LBUsedSNATPortsAlertSeverity": { + "value": "1" }, - "WSFDiskQueueLengthWindowSize": { + "LBUsedSNATPortsWindowSize": { "value": "PT5M" }, - "WSFDiskQueueLengthEvaluationFrequency": { + "LBUsedSNATPortsEvaluationFrequency": { "value": "PT1M" }, - "WSFDiskQueueLengthPolicyEffect": { + "LBUsedSNATPortsPolicyEffect": { "value": "deployIfNotExists" }, - "WSFDiskQueueLengthAlertState": { + "LBUsedSNATPortsAlertState": { "value": "true" }, - "WSFHttpQueueLengthAlertSeverity": { + "TMEndpointHealthAlertSeverity": { "value": "2" }, - "WSFHttpQueueLengthWindowSize": { + "TMEndpointHealthWindowSize": { "value": "PT5M" }, - "WSFHttpQueueLengthEvaluationFrequency": { + "TMEndpointHealthEvaluationFrequency": { "value": "PT1M" }, - "WSFHttpQueueLengthPolicyEffect": { + "TMEndpointHealthPolicyEffect": { "value": "deployIfNotExists" }, - "WSFHttpQueueLengthAlertState": { + "TMEndpointHealthAlertState": { "value": "true" }, "CDNPOriginHealthPercentageAlertSeverity": { @@ -2036,583 +2175,587 @@ } } }, - "policyAssignmentParametersHybridVM": { + "policyAssignmentParametersNetworkChanges": { "value": { - "HybridVMHeartBeatRGAlertSeverity": { + "activityNSGDeletePolicyEffect": { + "value": "deployIfNotExists" + }, + "activityNSGDeleteAlertState": { + "value": "true" + }, + "activityUDRUpdatePolicyEffect": { + "value": "deployIfNotExists" + }, + "activityUDRUpdateAlertState": { + "value": "true" + } + } + }, + "policyAssignmentParametersRecoveryServices": { + "value": { + "RVBackupHealthMonitorPolicyEffect": { + "value": "modify" + } + } + }, + "policyAssignmentParametersStorage": { + "value": { + "StorageAccountAvailabilityAlertSeverity": { "value": "1" }, - "HybridVMHeartBeatRGWindowSize": { - "value": "PT15M" + "StorageAccountAvailabilityWindowSize": { + "value": "PT5M" }, - "HybridVMHeartBeatRGEvaluationFrequency": { + "StorageAccountAvailabilityFrequency": { "value": "PT5M" }, - "HybridVMHeartBeatRGAutoMitigate": { + "StorageAccountAvailabilityPolicyEffect": { + "value": "deployIfNotExists" + }, + "StorageAccountAvailabilityAlertState": { "value": "true" }, - "HybridVMHeartBeatRGAutoResolve": { + "StorageAccountAvailabilityThreshold": { + "value": "90" + }, + "StorageAccountDeletePolicyEffect": { + "value": "deployIfNotExists" + }, + "StorageAccountDeleteAlertState": { + "value": "true" + } + } + }, + "policyAssignmentParametersVM": { + "value": { + "VMHeartBeatRGAlertSeverity": { + "value": "1" + }, + "VMHeartBeatRGWindowSize": { + "value": "PT6H" + }, + "VMHeartBeatRGEvaluationFrequency": { + "value": "PT5M" + }, + "VMHeartBeatRGAutoMitigate": { "value": "true" }, - "HybridVMHeartBeatRGAutoResolveTime": { + "VMHeartBeatRGAutoResolve": { + "value": "true" + }, + "VMHeartBeatRGAutoResolveTime": { "value": "00:10:00" }, - "HybridVMHeartBeatRGPolicyEffect": { + "VMHeartBeatRGPolicyEffect": { "value": "deployIfNotExists" }, - "HybridVMHeartBeatRGAlertState": { + "VMHeartBeatRGAlertState": { "value": "true" }, - "HybridVMHeartBeatRGThreshold": { + "VMHeartBeatRGThreshold": { "value": "10" }, - "HybridVMHeartBeatRGOperator": { + "VMHeartBeatRGOperator": { "value": "GreaterThan" }, - "HybridVMHeartBeatRGTimeAggregation": { - "value": "Average" + "VMHeartBeatRGTimeAggregation": { + "value": "Count" }, - "HybridVMNetworkInAlertSeverity": { + "VMHeartBeatRGComputersToInclude": { + "value": [ + "*" + ] + }, + "VMHeartBeatRGFailingPeriods": { + "value": "1" + }, + "VMNetworkInAlertSeverity": { "value": "2" }, - "HybridVMNetworkInWindowSize": { + "VMNetworkInWindowSize": { "value": "PT15M" }, - "HybridVMNetworkInEvaluationFrequency": { + "VMNetworkInEvaluationFrequency": { "value": "PT5M" }, - "HybridVMNetworkInAutoMitigate": { + "VMNetworkInAutoMitigate": { "value": "true" }, - "HybridVMNetworkInAutoResolve": { + "VMNetworkInAutoResolve": { "value": "true" }, - "HybridVMNetworkInAutoResolveTime": { + "VMNetworkInAutoResolveTime": { "value": "00:10:00" }, - "HybridVMNetworkInPolicyEffect": { + "VMNetworkInPolicyEffect": { "value": "deployIfNotExists" }, - "HybridVMNetworkInAlertState": { + "VMNetworkInAlertState": { "value": "true" }, - "HybridVMNetworkInThreshold": { + "VMNetworkInThreshold": { "value": "10000000" }, - "HybridVMNetworkInOperator": { + "VMNetworkInOperator": { "value": "GreaterThan" }, - "HybridVMNetworkInTimeAggregation": { - "value": "Average" + "VMNetworkInTimeAggregation": { + "value": "Count" }, - "HybridVMNetworkInEvaluationPeriods": { + "VMNetworkInEvaluationPeriods": { "value": "1" }, - "HybridVMNetworkInFailingPeriods": { + "VMNetworkInFailingPeriods": { "value": "1" }, - "HybridVMNetworkInComputersToInclude": { - "value": [ - "*" - ] - }, - "HybridVMNetworkInNetworkInterfaceToInclude": { + "VMNetworkInComputersToInclude": { "value": [ "*" ] }, - "HybridVMNetworkOutAlertSeverity": { + "VMNetworkOutAlertSeverity": { "value": "2" }, - "HybridVMNetworkOutWindowSize": { + "VMNetworkOutWindowSize": { "value": "PT15M" }, - "HybridVMNetworkOutEvaluationFrequency": { + "VMNetworkOutEvaluationFrequency": { "value": "PT5M" }, - "HybridVMNetworkOutAutoMitigate": { + "VMNetworkOutAutoMitigate": { "value": "true" }, - "HybridVMNetworkOutAutoResolve": { + "VMNetworkOutAutoResolve": { "value": "true" }, - "HybridVMNetworkOutAutoResolveTime": { + "VMNetworkOutAutoResolveTime": { "value": "00:10:00" }, - "HybridVMNetworkOutPolicyEffect": { + "VMNetworkOutPolicyEffect": { "value": "deployIfNotExists" }, - "HybridVMNetworkOutAlertState": { + "VMNetworkOutAlertState": { "value": "true" }, - "HybridVMNetworkOutThreshold": { + "VMNetworkOutThreshold": { "value": "10000000" }, - "HybridVMNetworkOutOperator": { + "VMNetworkOutOperator": { "value": "GreaterThan" }, - "HybridVMNetworkOutTimeAggregation": { - "value": "Average" + "VMNetworkOutTimeAggregation": { + "value": "Count" }, - "HybridVMNetworkOutEvaluationPeriods": { + "VMNetworkOutEvaluationPeriods": { "value": "1" }, - "HybridVMNetworkOutFailingPeriods": { + "VMNetworkOutFailingPeriods": { "value": "1" }, - "HybridVMNetworkOutComputersToInclude": { - "value": [ - "*" - ] - }, - "HybridVMNetworkOutNetworkInterfaceToInclude": { + "VMNetworkOutComputersToInclude": { "value": [ "*" ] }, - "HybridVMOSDiskReadLatencyAlertSeverity": { + "VMOSDiskReadLatencyAlertSeverity": { "value": "2" }, - "HybridVMOSDiskReadLatencyWindowSize": { + "VMOSDiskReadLatencyWindowSize": { "value": "PT15M" }, - "HybridVMOSDiskReadLatencyEvaluationFrequency": { + "VMOSDiskReadLatencyEvaluationFrequency": { "value": "PT5M" }, - "HybridVMOSDiskReadLatencyAutoMitigate": { + "VMOSDiskReadLatencyAutoMitigate": { "value": "true" }, - "HybridVMOSDiskReadLatencyAutoResolve": { + "VMOSDiskReadLatencyAutoResolve": { "value": "true" }, - "HybridVMOSDiskReadLatencyAutoResolveTime": { + "VMOSDiskReadLatencyAutoResolveTime": { "value": "00:10:00" }, - "HybridVMOSDiskReadLatencyPolicyEffect": { + "VMOSDiskReadLatencyPolicyEffect": { "value": "deployIfNotExists" }, - "HybridVMOSDiskReadLatencyAlertState": { + "VMOSDiskReadLatencyAlertState": { "value": "true" }, - "HybridVMOSDiskReadLatencyThreshold": { + "VMOSDiskReadLatencyThreshold": { "value": "30" }, - "HybridVMOSDiskReadLatencyOperator": { + "VMOSDiskReadLatencyOperator": { "value": "GreaterThan" }, - "HybridVMOSDiskReadLatencyTimeAggregation": { - "value": "Average" + "VMOSDiskReadLatencyTimeAggregation": { + "value": "Count" }, - "HybridVMOSDiskReadLatencyEvaluationPeriods": { + "VMOSDiskReadLatencyEvaluationPeriods": { "value": "1" }, - "HybridVMOSDiskReadLatencyFailingPeriods": { + "VMOSDiskReadLatencyFailingPeriods": { "value": "1" }, - "HybridVMOSDiskReadLatencyComputersToInclude": { + "VMOSDiskReadLatencyComputersToInclude": { "value": [ "*" ] }, - "HybridVMOSDiskReadLatencyDisksToInclude": { - "value": [ - "C:", - "/" - ] - }, - "HybridVMOSDiskWriteLatencyAlertSeverity": { + "VMOSDiskWriteLatencyAlertSeverity": { "value": "2" }, - "HybridVMOSDiskWriteLatencyWindowSize": { + "VMOSDiskWriteLatencyWindowSize": { "value": "PT15M" }, - "HybridVMOSDiskWriteLatencyEvaluationFrequency": { + "VMOSDiskWriteLatencyEvaluationFrequency": { "value": "PT5M" }, - "HybridVMOSDiskWriteLatencyAutoMitigate": { + "VMOSDiskWriteLatencyAutoMitigate": { "value": "true" }, - "HybridVMOSDiskWriteLatencyAutoResolve": { + "VMOSDiskWriteLatencyAutoResolve": { "value": "true" }, - "HybridVMOSDiskWriteLatencyAutoResolveTime": { + "VMOSDiskWriteLatencyAutoResolveTime": { "value": "00:10:00" }, - "HybridVMOSDiskWriteLatencyPolicyEffect": { + "VMOSDiskWriteLatencyPolicyEffect": { "value": "deployIfNotExists" }, - "HybridVMOSDiskWriteLatencyAlertState": { + "VMOSDiskWriteLatencyAlertState": { "value": "true" }, - "HybridVMOSDiskWriteLatencyThreshold": { - "value": "50" + "VMOSDiskWriteLatencyThreshold": { + "value": "30" }, - "HybridVMOSDiskWriteLatencyOperator": { + "VMOSDiskWriteLatencyOperator": { "value": "GreaterThan" }, - "HybridVMOSDiskWriteLatencyTimeAggregation": { - "value": "Average" + "VMOSDiskWriteLatencyTimeAggregation": { + "value": "Count" }, - "HybridVMOSDiskWriteLatencyEvaluationPeriods": { + "VMOSDiskWriteLatencyEvaluationPeriods": { "value": "1" }, - "HybridVMOSDiskWriteLatencyFailingPeriods": { + "VMOSDiskWriteLatencyFailingPeriods": { "value": "1" }, - "HybridVMOSDiskWriteLatencyComputersToInclude": { + "VMOSDiskWriteLatencyComputersToInclude": { "value": [ "*" ] }, - "HybridVMOSDiskWriteLatencyDisksToInclude": { - "value": [ - "C:", - "/" - ] - }, - "HybridVMOSDiskSpaceAlertSeverity": { + "VMOSDiskSpaceAlertSeverity": { "value": "2" }, - "HybridVMOSDiskSpaceWindowSize": { + "VMOSDiskSpaceWindowSize": { "value": "PT15M" }, - "HybridVMOSDiskSpaceEvaluationFrequency": { + "VMOSDiskSpaceEvaluationFrequency": { "value": "PT5M" }, - "HybridVMOSDiskSpaceAutoMitigate": { + "VMOSDiskSpaceAutoMitigate": { "value": "true" }, - "HybridVMOSDiskSpaceAutoResolve": { + "VMOSDiskSpaceAutoResolve": { "value": "true" }, - "HybridVMOSDiskSpaceAutoResolveTime": { + "VMOSDiskSpaceAutoResolveTime": { "value": "00:10:00" }, - "HybridVMOSDiskSpacePolicyEffect": { + "VMOSDiskSpacePolicyEffect": { "value": "deployIfNotExists" }, - "HybridVMOSDiskSpaceAlertState": { + "VMOSDiskSpaceAlertState": { "value": "true" }, - "HybridVMOSDiskSpaceThreshold": { + "VMOSDiskSpaceThreshold": { "value": "10" }, - "HybridVMOSDiskSpaceOperator": { - "value": "LessThan" + "VMOSDiskSpaceOperator": { + "value": "GreaterThan" }, - "HybridVMOSDiskSpaceTimeAggregation": { - "value": "Average" + "VMOSDiskSpaceTimeAggregation": { + "value": "Count" }, - "HybridVMOSDiskSpaceEvaluationPeriods": { + "VMOSDiskSpaceEvaluationPeriods": { "value": "1" }, - "HybridVMOSDiskSpaceFailingPeriods": { + "VMOSDiskSpaceFailingPeriods": { "value": "1" }, - "HybridVMOSDiskSpaceComputersToInclude": { + "VMOSDiskSpaceComputersToInclude": { "value": [ "*" ] }, - "HybridVMOSDiskSpaceDisksToInclude": { - "value": [ - "C:", - "/" - ] - }, - "HybridVMPercentCPUAlertSeverity": { + "VMPercentCPUAlertSeverity": { "value": "2" }, - "HybridVMPercentCPUWindowSize": { + "VMPercentCPUWindowSize": { "value": "PT15M" }, - "HybridVMPercentCPUEvaluationFrequency": { + "VMPercentCPUEvaluationFrequency": { "value": "PT5M" }, - "HybridVMPercentCPUAutoMitigate": { + "VMPercentCPUAutoMitigate": { "value": "true" }, - "HybridVMPercentCPUAutoResolve": { + "VMPercentCPUAutoResolve": { "value": "true" }, - "HybridVMPercentCPUAutoResolveTime": { + "VMPercentCPUAutoResolveTime": { "value": "00:10:00" }, - "HybridVMPercentCPUPolicyEffect": { + "VMPercentCPUPolicyEffect": { "value": "deployIfNotExists" }, - "HybridVMPercentCPUAlertState": { + "VMPercentCPUAlertState": { "value": "true" }, - "HybridVMPercentCPUThreshold": { + "VMPercentCPUThreshold": { "value": "85" }, - "HybridVMPercentCPUOperator": { + "VMPercentCPUOperator": { "value": "GreaterThan" }, - "HybridVMPercentCPUTimeAggregation": { - "value": "Average" + "VMPercentCPUTimeAggregation": { + "value": "Count" }, - "HybridVMPercentMemoryAlertSeverity": { + "VMPercentCPUFailingPeriods": { + "value": "1" + }, + "VMPercentMemoryAlertSeverity": { "value": "2" }, - "HybridVMPercentMemoryWindowSize": { + "VMPercentMemoryWindowSize": { "value": "PT15M" }, - "HybridVMPercentMemoryEvaluationFrequency": { + "VMPercentMemoryEvaluationFrequency": { "value": "PT5M" }, - "HybridVMPercentMemoryAutoMitigate": { + "VMPercentMemoryAutoMitigate": { "value": "true" }, - "HybridVMPercentMemoryAutoResolve": { + "VMPercentMemoryAutoResolve": { "value": "true" }, - "HybridVMPercentMemoryAutoResolveTime": { + "VMPercentMemoryAutoResolveTime": { "value": "00:10:00" }, - "HybridVMPercentMemoryPolicyEffect": { + "VMPercentMemoryPolicyEffect": { "value": "deployIfNotExists" }, - "HybridVMPercentMemoryAlertState": { + "VMPercentMemoryAlertState": { "value": "true" }, - "HybridVMPercentMemoryThreshold": { + "VMPercentMemoryThreshold": { "value": "10" }, - "HybridVMPercentMemoryOperator": { - "value": "LessThan" + "VMPercentMemoryOperator": { + "value": "GreaterThan" }, - "HybridVMPercentMemoryTimeAggregation": { - "value": "Average" + "VMPercentMemoryTimeAggregation": { + "value": "Count" }, - "HybridVMDataDiskSpaceAlertSeverity": { + "VMPercentMemoryFailingPeriods": { + "value": "1" + }, + "VMDataDiskSpaceAlertSeverity": { "value": "2" }, - "HybridVMDataDiskSpaceWindowSize": { + "VMDataDiskSpaceWindowSize": { "value": "PT15M" }, - "HybridVMDataDiskSpaceEvaluationFrequency": { + "VMDataDiskSpaceEvaluationFrequency": { "value": "PT5M" }, - "HybridVMDataDiskSpaceAutoMitigate": { + "VMDataDiskSpaceAutoMitigate": { "value": "true" }, - "HybridVMDataDiskSpaceAutoResolve": { + "VMDataDiskSpaceAutoResolve": { "value": "true" }, - "HybridVMDataDiskSpaceAutoResolveTime": { + "VMDataDiskSpaceAutoResolveTime": { "value": "00:10:00" }, - "HybridVMDataDiskSpacePolicyEffect": { + "VMDataDiskSpacePolicyEffect": { "value": "deployIfNotExists" }, - "HybridVMDataDiskSpaceAlertState": { + "VMDataDiskSpaceAlertState": { "value": "true" }, - "HybridVMDataDiskSpaceThreshold": { + "VMDataDiskSpaceThreshold": { "value": "10" }, - "HybridVMDataDiskSpaceOperator": { - "value": "LessThan" + "VMDataDiskSpaceOperator": { + "value": "GreaterThan" }, - "HybridVMDataDiskSpaceTimeAggregation": { - "value": "Average" + "VMDataDiskSpaceTimeAggregation": { + "value": "Count" }, - "HybridVMDataDiskSpaceEvaluationPeriods": { + "VMDataDiskSpaceEvaluationPeriods": { "value": "1" }, - "HybridVMDataDiskSpaceFailingPeriods": { + "VMDataDiskSpaceFailingPeriods": { "value": "1" }, - "HybridVMDataDiskSpaceDisksToInclude": { - "value": [ - "*" - ] - }, - "HybridVMDataDiskReadLatencyAlertSeverity": { + "VMDataDiskReadLatencyAlertSeverity": { "value": "2" }, - "HybridVMDataDiskReadLatencyWindowSize": { + "VMDataDiskReadLatencyWindowSize": { "value": "PT15M" }, - "HybridVMDataDiskReadLatencyEvaluationFrequency": { + "VMDataDiskReadLatencyEvaluationFrequency": { "value": "PT5M" }, - "HybridVMDataDiskReadLatencyAutoMitigate": { + "VMDataDiskReadLatencyAutoMitigate": { "value": "true" }, - "HybridVMDataDiskReadLatencyAutoResolve": { + "VMDataDiskReadLatencyAutoResolve": { "value": "true" }, - "HybridVMDataDiskReadLatencyAutoResolveTime": { + "VMDataDiskReadLatencyAutoResolveTime": { "value": "00:10:00" }, - "HybridVMDataDiskReadLatencyPolicyEffect": { + "VMDataDiskReadLatencyPolicyEffect": { "value": "deployIfNotExists" }, - "HybridVMDataDiskReadLatencyAlertState": { + "VMDataDiskReadLatencyAlertState": { "value": "true" }, - "HybridVMDataDiskReadLatencyThreshold": { + "VMDataDiskReadLatencyThreshold": { "value": "30" }, - "HybridVMDataDiskReadLatencyOperator": { + "VMDataDiskReadLatencyOperator": { "value": "GreaterThan" }, - "HybridVMDataDiskReadLatencyTimeAggregation": { - "value": "Average" + "VMDataDiskReadLatencyTimeAggregation": { + "value": "Count" }, - "HybridVMDataDiskReadLatencyEvaluationPeriods": { + "VMDataDiskReadLatencyEvaluationPeriods": { "value": "1" }, - "HybridVMDataDiskReadLatencyFailingPeriods": { + "VMDataDiskReadLatencyFailingPeriods": { "value": "1" }, - "HybridVMDataDiskReadLatencyComputersToInclude": { - "value": [ - "*" - ] - }, - "HybridVMDataDiskReadLatencyDisksToInclude": { + "VMDataDiskReadLatencyComputersToInclude": { "value": [ "*" ] }, - "HybridVMDataDiskWriteLatencyAlertSeverity": { + "VMDataDiskWriteLatencyAlertSeverity": { "value": "2" }, - "HybridVMDataDiskWriteLatencyWindowSize": { + "VMDataDiskWriteLatencyWindowSize": { "value": "PT15M" }, - "HybridVMDataDiskWriteLatencyEvaluationFrequency": { + "VMDataDiskWriteLatencyEvaluationFrequency": { "value": "PT5M" }, - "HybridVMDataDiskWriteLatencyAutoMitigate": { + "VMDataDiskWriteLatencyAutoMitigate": { "value": "true" }, - "HybridVMDataDiskWriteLatencyAutoResolve": { + "VMDataDiskWriteLatencyAutoResolve": { "value": "true" }, - "HybridVMDataDiskWriteLatencyAutoResolveTime": { + "VMDataDiskWriteLatencyAutoResolveTime": { "value": "00:10:00" }, - "HybridVMDataDiskWriteLatencyPolicyEffect": { + "VMDataDiskWriteLatencyPolicyEffect": { "value": "deployIfNotExists" }, - "HybridVMDataDiskWriteLatencyAlertState": { + "VMDataDiskWriteLatencyAlertState": { "value": "true" }, - "HybridVMDataDiskWriteLatencyThreshold": { + "VMDataDiskWriteLatencyThreshold": { "value": "30" }, - "HybridVMDataDiskWriteLatencyOperator": { + "VMDataDiskWriteLatencyOperator": { "value": "GreaterThan" }, - "HybridVMDataDiskWriteLatencyTimeAggregation": { - "value": "Average" + "VMDataDiskWriteLatencyTimeAggregation": { + "value": "Count" }, - "HybridVMDataDiskWriteLatencyEvaluationPeriods": { + "VMDataDiskWriteLatencyEvaluationPeriods": { "value": "1" }, - "HybridVMDataDiskWriteLatencyFailingPeriods": { + "VMDataDiskWriteLatencyFailingPeriods": { "value": "1" }, - "HybridVMDataDiskWriteLatencyComputersToInclude": { - "value": [ - "*" - ] - }, - "HybridVMDataDiskWriteLatencyDisksToInclude": { + "VMDataDiskWriteLatencyComputersToInclude": { "value": [ "*" ] + } + } + }, + "policyAssignmentParametersWeb": { + "value": { + "WSFCPUPercentageAlertSeverity": { + "value": "2" }, - "HybridVMDisconnectedAlertSeverity": { - "value": "1" - }, - "HybridVMDisconnectedAlertWindowSize": { - "value": "P1D" - }, - "HybridVMDisconnectedAlertEvaluationFrequency": { - "value": "P1D" + "WSFCPUPercentageWindowSize": { + "value": "PT5M" }, - "HybridVMDisconnectedAlertAutoMitigate": { - "value": "false" + "WSFCPUPercentageEvaluationFrequency": { + "value": "PT1M" }, - "HybridVMDisconnectedAlertPolicyEffect": { + "WSFCPUPercentagePolicyEffect": { "value": "deployIfNotExists" }, - "HybridVMDisconnectedAlertState": { + "WSFCPUPercentageAlertState": { "value": "true" }, - "HybridVMDisconnectedAlertDaysThreshold": { - "value": "45" - }, - "HybridVMDisconnectedAlertOperator": { - "value": "GreaterThan" - }, - "HybridVMDisconnectedAlertTimeAggregation": { - "value": "Count" - }, - "HybridVMDisconnectedAlertEvaluationPeriods": { - "value": "1" + "WSFCPUPercentageThreshold": { + "value": "90" }, - "HybridVMDisconnectedAlertFailingPeriods": { - "value": "1" - } - } - }, - "policyAssignmentParametersManagement": { - "value": { - "AATotalJobAlertSeverity": { + "WSFMemoryPercentageAlertSeverity": { "value": "2" }, - "AATotalJobAlertWindowSize": { + "WSFMemoryPercentageWindowSize": { "value": "PT5M" }, - "AATotalJobAlertEvaluationFrequency": { + "WSFMemoryPercentageEvaluationFrequency": { "value": "PT1M" }, - "AATotalJobAlertPolicyEffect": { + "WSFMemoryPercentagePolicyEffect": { "value": "deployIfNotExists" }, - "AATotalJobAlertAlertState": { + "WSFMemoryPercentageAlertState": { "value": "true" }, - "AATotalJobAlertThreshold": { - "value": "20" - }, - "RVBackupHealthMonitorPolicyEffect": { - "value": "modify" + "WSFMemoryPercentageThreshold": { + "value": "85" }, - "StorageAccountAvailabilityAlertSeverity": { - "value": "1" + "WSFDiskQueueLengthAlertSeverity": { + "value": "2" }, - "StorageAccountAvailabilityWindowSize": { + "WSFDiskQueueLengthWindowSize": { "value": "PT5M" }, - "StorageAccountAvailabilityFrequency": { - "value": "PT5M" + "WSFDiskQueueLengthEvaluationFrequency": { + "value": "PT1M" }, - "StorageAccountAvailabilityPolicyEffect": { + "WSFDiskQueueLengthPolicyEffect": { "value": "deployIfNotExists" }, - "StorageAccountAvailabilityAlertState": { + "WSFDiskQueueLengthAlertState": { "value": "true" }, - "StorageAccountAvailabilityThreshold": { - "value": "90" + "WSFHttpQueueLengthAlertSeverity": { + "value": "2" }, - "StorageAccountDeletePolicyEffect": { - "value": "deployIfNotExists" + "WSFHttpQueueLengthWindowSize": { + "value": "PT5M" }, - "StorageAccountDeleteAlertState": { - "value": "true" + "WSFHttpQueueLengthEvaluationFrequency": { + "value": "PT1M" }, - "activityLAWDeleteAlertState": { - "value": "true" + "WSFHttpQueueLengthPolicyEffect": { + "value": "deployIfNotExists" }, - "activityLAWKeyRegenAlertState": { + "WSFHttpQueueLengthAlertState": { "value": "true" } } diff --git a/patterns/alz/policyAssignments/DINE-ConnectivityAssignment.json b/patterns/alz/policyAssignments/DINE-ConnectivityAssignment.json index 10ddcde9f..1e8c39b8d 100644 --- a/patterns/alz/policyAssignments/DINE-ConnectivityAssignment.json +++ b/patterns/alz/policyAssignments/DINE-ConnectivityAssignment.json @@ -31,7 +31,7 @@ }, "policyAssignmentNames": { "ambaConnectivity": "Deploy-AMBA-Connectivity", - "description": "Initiative to deploy AMBA alerts relevant to the ALZ Connectivity management group", + "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Network components such as Azure Firewalls, ExpressRoute, VPN, and Private DNS Zones.", "displayName": "Deploy Azure Monitor Baseline Alerts for Connectivity" }, "nonComplianceMessage": { diff --git a/patterns/alz/policyAssignments/DINE-HybridVMAssignment.json b/patterns/alz/policyAssignments/DINE-HybridVMAssignment.json index 3669966bf..754915a59 100644 --- a/patterns/alz/policyAssignments/DINE-HybridVMAssignment.json +++ b/patterns/alz/policyAssignments/DINE-HybridVMAssignment.json @@ -20,6 +20,32 @@ "policyAssignmentParameters": { "type": "object", "defaultValue": {} + }, + "scope": { + "type": "String", + "metadata": { + "displayName": "Scope", + "description": "Scope of the policy assignment" + } + }, + "uamiScope": { + "type": "String", + "metadata": { + "displayName": "Platform Scope", + "description": "Scope of the reader role assignment" + }, + "defaultValue": "[parameters('scope')]" + }, + "bringYourOwnUserAssignedManagedIdentity": { + "type": "string", + "defaultValue": "No", + "allowedValues": [ + "Yes", + "No" + ], + "metadata": { + "description": "Specify if you want to bring your own user assigned managed identity for monitoring purpose." + } } }, "variables": { @@ -28,7 +54,7 @@ }, "policyAssignmentNames": { "ambaHybridVM": "Deploy-AMBA-HybridVM", - "description": "Initiative to deploy AMBA Hybrid VM alerts", + "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Azure Arc-enabled Servers.", "displayName": "Deploy Azure Monitor Baseline Alerts for Hybrid VMs" }, "nonComplianceMessage": { @@ -37,8 +63,10 @@ "DoNotEnforce": "should" }, "rbacContributor": "b24988ac-6180-42a0-ab88-20f7382dd24c", + "rbacManagedIdentityOperator": "f1a07417-d97a-45cb-824c-7a7467783830", "roleAssignmentNames": { - "deployAMBAHybridVM": "[guid(concat(parameters('topLevelManagementGroupPrefix'), variables('policyAssignmentNames').ambaHybridVM))]" + "roleAssignmentNameContributor": "[guid(concat(parameters('topLevelManagementGroupPrefix'), variables('policyAssignmentNames').ambaHybridVM,parameters('scope')))]", + "roleAssignmentNameManagedIdentityOperator": "[guid(concat(parameters('toplevelManagementGroupPrefix'),variables('policyAssignmentNames').ambaHybridVM,'-1',parameters('scope')))]" } }, "resources": [ @@ -69,7 +97,7 @@ { "type": "Microsoft.Authorization/roleAssignments", "apiVersion": "2022-04-01", - "name": "[variables('roleAssignmentNames').deployAMBAHybridVM]", + "name": "[variables('roleAssignmentNames').roleAssignmentNameContributor]", "dependsOn": [ "[variables('policyAssignmentNames').ambaHybridVM]" ], @@ -79,6 +107,22 @@ "principalId": "[toLower(reference(concat('/providers/Microsoft.Authorization/policyAssignments/', variables('policyAssignmentNames').ambaHybridVM), '2019-09-01', 'Full' ).identity.principalId)]", "description": "_deployed_by_amba" } + }, + { + "condition": "[and(not(equals(parameters('uamiScope'), parameters('scope'))), equals(parameters('bringYourOwnUserAssignedManagedIdentity'), 'No'))]", + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "name": "[variables('roleAssignmentNames').roleAssignmentNameManagedIdentityOperator]", + "scope": "[tenantResourceId('Microsoft.Management/managementGroups/', parameters('uamiScope'))]", + "dependsOn": [ + "[variables('policyAssignmentNames').ambaHybridVM]" + ], + "properties": { + "principalType": "ServicePrincipal", + "roleDefinitionId": "[concat('/providers/Microsoft.Authorization/roleDefinitions/', variables('rbacManagedIdentityOperator'))]", + "principalId": "[toLower(reference(concat('/providers/Microsoft.Authorization/policyAssignments/', variables('policyAssignmentNames').ambaHybridVM), '2019-09-01', 'Full' ).identity.principalId)]", + "description": "_deployed_by_amba" + } } ], "outputs": {} diff --git a/patterns/alz/policyAssignments/DINE-KeyManagementAssignment.json b/patterns/alz/policyAssignments/DINE-KeyManagementAssignment.json new file mode 100644 index 000000000..d2a5f5351 --- /dev/null +++ b/patterns/alz/policyAssignments/DINE-KeyManagementAssignment.json @@ -0,0 +1,88 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-08-01/managementGroupDeploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "topLevelManagementGroupPrefix": { + "type": "string", + "metadata": { + "description": "Provide the ESLZ prefix to your intermediate root management group containing the policy definitions." + } + }, + "enforcementMode": { + "type": "string", + "allowedValues": [ + "Default", + "DoNotEnforce" + ], + "defaultValue": "Default" + }, + "nonComplianceMessagePlaceholder": { + "type": "string", + "defaultValue": "{enforcementMode}" + }, + "policyAssignmentParameters": { + "type": "object", + "defaultValue": {} + } + }, + "variables": { + "policyDefinitions": { + "deployAMBAKeyManagement": "[concat('/providers/Microsoft.Management/managementGroups/', parameters('topLevelManagementGroupPrefix'), '/providers/Microsoft.Authorization/policySetDefinitions/Alerting-KeyManagement')]" + }, + "policyAssignmentNames": { + "ambaKeyManagement": "Deploy-AMBA-KeyMgmt", + "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Key Management Services such as Azure Key Vault, and Managed HSM.", + "displayName": "Deploy Azure Monitor Baseline Alerts for Key Management" + }, + "nonComplianceMessage": { + "message": "Alerting {enforcementMode} be deployed to Azure services.", + "Default": "must", + "DoNotEnforce": "should" + }, + "rbacContributor": "b24988ac-6180-42a0-ab88-20f7382dd24c", + "roleAssignmentNames": { + "deployAMBAKeyManagement": "[guid(concat(parameters('topLevelManagementGroupPrefix'), variables('policyAssignmentNames').ambaKeyManagement))]" + } + }, + "resources": [ + { + "type": "Microsoft.Authorization/policyAssignments", + "apiVersion": "2020-09-01", + "name": "[variables('policyAssignmentNames').ambaKeyManagement]", + "location": "[deployment().location]", + "identity": { + "type": "SystemAssigned" + }, + "properties": { + "description": "[variables('policyAssignmentNames').description]", + "displayName": "[variables('policyAssignmentNames').displayName]", + "policyDefinitionId": "[variables('policyDefinitions').deployAMBAKeyManagement]", + "enforcementMode": "[parameters('enforcementMode')]", + "nonComplianceMessages": [ + { + "message": "[replace(variables('nonComplianceMessage').message, parameters('nonComplianceMessagePlaceholder'), variables('nonComplianceMessage')[parameters('enforcementMode')])]" + } + ], + "parameters": "[parameters('policyAssignmentParameters')]", + "metadata": { + "_deployed_by_amba": true + } + } + }, + { + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "name": "[variables('roleAssignmentNames').deployAMBAKeyManagement]", + "dependsOn": [ + "[variables('policyAssignmentNames').ambaKeyManagement]" + ], + "properties": { + "principalType": "ServicePrincipal", + "roleDefinitionId": "[concat('/providers/Microsoft.Authorization/roleDefinitions/', variables('rbacContributor'))]", + "principalId": "[toLower(reference(concat('/providers/Microsoft.Authorization/policyAssignments/', variables('policyAssignmentNames').ambaKeyManagement), '2019-09-01', 'Full' ).identity.principalId)]", + "description": "_deployed_by_amba" + } + } + ], + "outputs": {} +} diff --git a/patterns/alz/policyAssignments/DINE-LoadBalancingAssignment.json b/patterns/alz/policyAssignments/DINE-LoadBalancingAssignment.json new file mode 100644 index 000000000..2a04cac0e --- /dev/null +++ b/patterns/alz/policyAssignments/DINE-LoadBalancingAssignment.json @@ -0,0 +1,88 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-08-01/managementGroupDeploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "topLevelManagementGroupPrefix": { + "type": "string", + "metadata": { + "description": "Provide the ESLZ prefix to your intermediate root management group containing the policy definitions." + } + }, + "enforcementMode": { + "type": "string", + "allowedValues": [ + "Default", + "DoNotEnforce" + ], + "defaultValue": "Default" + }, + "nonComplianceMessagePlaceholder": { + "type": "string", + "defaultValue": "{enforcementMode}" + }, + "policyAssignmentParameters": { + "type": "object", + "defaultValue": {} + } + }, + "variables": { + "policyDefinitions": { + "deployAMBALoadBalancing": "[concat('/providers/Microsoft.Management/managementGroups/', parameters('topLevelManagementGroupPrefix'), '/providers/Microsoft.Authorization/policySetDefinitions/Alerting-LoadBalancing')]" + }, + "policyAssignmentNames": { + "ambaLoadBalancing": "Deploy-AMBA-LoadBalance", + "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Load Balancing Services such as Load Balancer, Application Gateway, Traffic Manager, and Azure Front Door.", + "displayName": "Deploy Azure Monitor Baseline Alerts for Load Balancing" + }, + "nonComplianceMessage": { + "message": "Alerting {enforcementMode} be deployed to Azure services.", + "Default": "must", + "DoNotEnforce": "should" + }, + "rbacContributor": "b24988ac-6180-42a0-ab88-20f7382dd24c", + "roleAssignmentNames": { + "deployAMBALoadBalancing": "[guid(concat(parameters('topLevelManagementGroupPrefix'), variables('policyAssignmentNames').ambaLoadBalancing))]" + } + }, + "resources": [ + { + "type": "Microsoft.Authorization/policyAssignments", + "apiVersion": "2020-09-01", + "name": "[variables('policyAssignmentNames').ambaLoadBalancing]", + "location": "[deployment().location]", + "identity": { + "type": "SystemAssigned" + }, + "properties": { + "description": "[variables('policyAssignmentNames').description]", + "displayName": "[variables('policyAssignmentNames').displayName]", + "policyDefinitionId": "[variables('policyDefinitions').deployAMBALoadBalancing]", + "enforcementMode": "[parameters('enforcementMode')]", + "nonComplianceMessages": [ + { + "message": "[replace(variables('nonComplianceMessage').message, parameters('nonComplianceMessagePlaceholder'), variables('nonComplianceMessage')[parameters('enforcementMode')])]" + } + ], + "parameters": "[parameters('policyAssignmentParameters')]", + "metadata": { + "_deployed_by_amba": true + } + } + }, + { + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "name": "[variables('roleAssignmentNames').deployAMBALoadBalancing]", + "dependsOn": [ + "[variables('policyAssignmentNames').ambaLoadBalancing]" + ], + "properties": { + "principalType": "ServicePrincipal", + "roleDefinitionId": "[concat('/providers/Microsoft.Authorization/roleDefinitions/', variables('rbacContributor'))]", + "principalId": "[toLower(reference(concat('/providers/Microsoft.Authorization/policyAssignments/', variables('policyAssignmentNames').ambaLoadBalancing), '2019-09-01', 'Full' ).identity.principalId)]", + "description": "_deployed_by_amba" + } + } + ], + "outputs": {} +} diff --git a/patterns/alz/policyAssignments/DINE-ManagementAssignment.json b/patterns/alz/policyAssignments/DINE-ManagementAssignment.json index 8c6d323ca..ffa24e1e6 100644 --- a/patterns/alz/policyAssignments/DINE-ManagementAssignment.json +++ b/patterns/alz/policyAssignments/DINE-ManagementAssignment.json @@ -1,88 +1,132 @@ { - "$schema": "https://schema.management.azure.com/schemas/2019-08-01/managementGroupDeploymentTemplate.json#", - "contentVersion": "1.0.0.0", - "parameters": { - "topLevelManagementGroupPrefix": { - "type": "string", - "metadata": { - "description": "Provide the ESLZ prefix to your intermediate root management group containing the policy definitions." - } - }, - "enforcementMode": { - "type": "string", - "allowedValues": [ - "Default", - "DoNotEnforce" - ], - "defaultValue": "Default" - }, - "nonComplianceMessagePlaceholder": { - "type": "string", - "defaultValue": "{enforcementMode}" - }, - "policyAssignmentParameters": { - "type": "object", - "defaultValue": {} - } + "$schema": "https://schema.management.azure.com/schemas/2019-08-01/managementGroupDeploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "topLevelManagementGroupPrefix": { + "type": "string", + "metadata": { + "description": "Provide the ESLZ prefix to your intermediate root management group containing the policy definitions." + } }, - "variables": { - "policyDefinitions": { - "deployAMBAManagement": "[concat('/providers/Microsoft.Management/managementGroups/', parameters('topLevelManagementGroupPrefix'), '/providers/Microsoft.Authorization/policySetDefinitions/Alerting-Management')]" - }, - "policyAssignmentNames": { - "ambaManagement": "Deploy-AMBA-Management", - "description": "Initiative to deploy AMBA alerts relevant to the ALZ Management management group", - "displayName": "Deploy Azure Monitor Baseline Alerts for Management" - }, - "nonComplianceMessage": { - "message": "Alerting {enforcementMode} be deployed to Azure services.", - "Default": "must", - "DoNotEnforce": "should" - }, - "rbacContributor": "b24988ac-6180-42a0-ab88-20f7382dd24c", - "roleAssignmentNames": { - "deployAMBAManagement": "[guid(concat(parameters('topLevelManagementGroupPrefix'), variables('policyAssignmentNames').ambaManagement))]" - } + "enforcementMode": { + "type": "string", + "allowedValues": [ + "Default", + "DoNotEnforce" + ], + "defaultValue": "Default" + }, + "nonComplianceMessagePlaceholder": { + "type": "string", + "defaultValue": "{enforcementMode}" + }, + "policyAssignmentParameters": { + "type": "object", + "defaultValue": {} + }, + "scope": { + "type": "String", + "metadata": { + "displayName": "Scope", + "description": "Scope of the policy assignment" + } + }, + "uamiScope": { + "type": "String", + "metadata": { + "displayName": "Platform Scope", + "description": "Scope of the reader role assignment" + }, + "defaultValue": "[parameters('scope')]" }, - "resources": [ - { - "type": "Microsoft.Authorization/policyAssignments", - "apiVersion": "2020-09-01", - "name": "[variables('policyAssignmentNames').ambaManagement]", - "location": "[deployment().location]", - "identity": { - "type": "SystemAssigned" - }, - "properties": { - "description": "[variables('policyAssignmentNames').description]", - "displayName": "[variables('policyAssignmentNames').displayName]", - "policyDefinitionId": "[variables('policyDefinitions').deployAMBAManagement]", - "enforcementMode": "[parameters('enforcementMode')]", - "nonComplianceMessages": [ - { - "message": "[replace(variables('nonComplianceMessage').message, parameters('nonComplianceMessagePlaceholder'), variables('nonComplianceMessage')[parameters('enforcementMode')])]" - } - ], - "parameters": "[parameters('policyAssignmentParameters')]", - "metadata": { - "_deployed_by_amba": true - } - } - }, - { - "type": "Microsoft.Authorization/roleAssignments", - "apiVersion": "2022-04-01", - "name": "[variables('roleAssignmentNames').deployAMBAManagement]", - "dependsOn": [ - "[variables('policyAssignmentNames').ambaManagement]" - ], - "properties": { - "principalType": "ServicePrincipal", - "roleDefinitionId": "[concat('/providers/Microsoft.Authorization/roleDefinitions/', variables('rbacContributor'))]", - "principalId": "[toLower(reference(concat('/providers/Microsoft.Authorization/policyAssignments/', variables('policyAssignmentNames').ambaManagement), '2019-09-01', 'Full' ).identity.principalId)]", - "description": "_deployed_by_amba" - } + "bringYourOwnUserAssignedManagedIdentity": { + "type": "string", + "defaultValue": "No", + "allowedValues": [ + "Yes", + "No" + ], + "metadata": { + "description": "Specify if you want to bring your own user assigned managed identity for monitoring purpose." + } + } + }, + "variables": { + "policyDefinitions": { + "deployAMBAManagement": "[concat('/providers/Microsoft.Management/managementGroups/', parameters('topLevelManagementGroupPrefix'), '/providers/Microsoft.Authorization/policySetDefinitions/Alerting-Management')]" + }, + "policyAssignmentNames": { + "ambaManagement": "Deploy-AMBA-Management", + "description": "Initiative to deploy AMBA alerts relevant to the ALZ Management management group", + "displayName": "Deploy Azure Monitor Baseline Alerts for Management" + }, + "nonComplianceMessage": { + "message": "Alerting {enforcementMode} be deployed to Azure services.", + "Default": "must", + "DoNotEnforce": "should" + }, + "rbacContributor": "b24988ac-6180-42a0-ab88-20f7382dd24c", + "rbacManagedIdentityOperator": "f1a07417-d97a-45cb-824c-7a7467783830", + "roleAssignmentNames": { + "roleAssignmentNameContributor": "[guid(concat(parameters('topLevelManagementGroupPrefix'), variables('policyAssignmentNames').ambaManagement,parameters('scope')))]", + "roleAssignmentNameManagedIdentityOperator": "[guid(concat(parameters('toplevelManagementGroupPrefix'),variables('policyAssignmentNames').ambaManagement,'-1',parameters('scope')))]" + } + }, + "resources": [ + { + "type": "Microsoft.Authorization/policyAssignments", + "apiVersion": "2020-09-01", + "name": "[variables('policyAssignmentNames').ambaManagement]", + "location": "[deployment().location]", + "identity": { + "type": "SystemAssigned" + }, + "properties": { + "description": "[variables('policyAssignmentNames').description]", + "displayName": "[variables('policyAssignmentNames').displayName]", + "policyDefinitionId": "[variables('policyDefinitions').deployAMBAManagement]", + "enforcementMode": "[parameters('enforcementMode')]", + "nonComplianceMessages": [ + { + "message": "[replace(variables('nonComplianceMessage').message, parameters('nonComplianceMessagePlaceholder'), variables('nonComplianceMessage')[parameters('enforcementMode')])]" + } + ], + "parameters": "[parameters('policyAssignmentParameters')]", + "metadata": { + "_deployed_by_amba": true } - ], - "outputs": {} + } + }, + { + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "name": "[variables('roleAssignmentNames').roleAssignmentNameContributor]", + "dependsOn": [ + "[variables('policyAssignmentNames').ambaManagement]" + ], + "properties": { + "principalType": "ServicePrincipal", + "roleDefinitionId": "[concat('/providers/Microsoft.Authorization/roleDefinitions/', variables('rbacContributor'))]", + "principalId": "[toLower(reference(concat('/providers/Microsoft.Authorization/policyAssignments/', variables('policyAssignmentNames').ambaManagement), '2019-09-01', 'Full' ).identity.principalId)]", + "description": "_deployed_by_amba" + } + }, + { + "condition": "[and(not(equals(parameters('uamiScope'), parameters('scope'))), equals(parameters('bringYourOwnUserAssignedManagedIdentity'), 'No'))]", + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "name": "[variables('roleAssignmentNames').roleAssignmentNameManagedIdentityOperator]", + "scope": "[tenantResourceId('Microsoft.Management/managementGroups/', parameters('uamiScope'))]", + "dependsOn": [ + "[variables('policyAssignmentNames').ambaManagement]" + ], + "properties": { + "principalType": "ServicePrincipal", + "roleDefinitionId": "[concat('/providers/Microsoft.Authorization/roleDefinitions/', variables('rbacManagedIdentityOperator'))]", + "principalId": "[toLower(reference(concat('/providers/Microsoft.Authorization/policyAssignments/', variables('policyAssignmentNames').ambaManagement), '2019-09-01', 'Full' ).identity.principalId)]", + "description": "_deployed_by_amba" + } + } + ], + "outputs": {} } diff --git a/patterns/alz/policyAssignments/DINE-NetworkChangesAssignment.json b/patterns/alz/policyAssignments/DINE-NetworkChangesAssignment.json new file mode 100644 index 000000000..1aca71718 --- /dev/null +++ b/patterns/alz/policyAssignments/DINE-NetworkChangesAssignment.json @@ -0,0 +1,88 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-08-01/managementGroupDeploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "topLevelManagementGroupPrefix": { + "type": "string", + "metadata": { + "description": "Provide the ESLZ prefix to your intermediate root management group containing the policy definitions." + } + }, + "enforcementMode": { + "type": "string", + "allowedValues": [ + "Default", + "DoNotEnforce" + ], + "defaultValue": "Default" + }, + "nonComplianceMessagePlaceholder": { + "type": "string", + "defaultValue": "{enforcementMode}" + }, + "policyAssignmentParameters": { + "type": "object", + "defaultValue": {} + } + }, + "variables": { + "policyDefinitions": { + "deployAMBANetworkChanges": "[concat('/providers/Microsoft.Management/managementGroups/', parameters('topLevelManagementGroupPrefix'), '/providers/Microsoft.Authorization/policySetDefinitions/Alerting-NetworkChanges')]" + }, + "policyAssignmentNames": { + "ambaNetworkChanges": "Deploy-AMBA-NetworkChang", + "description": "This initiative implements Azure Monitor Baseline Alerts to monitor alterations in Network Routing and Security, such as modifications to Route Tables and the removal of Network Security Groups.", + "displayName": "Deploy Azure Monitor Baseline Alerts for Changes in Network Routing and Security" + }, + "nonComplianceMessage": { + "message": "Alerting {enforcementMode} be deployed to Azure services.", + "Default": "must", + "DoNotEnforce": "should" + }, + "rbacContributor": "b24988ac-6180-42a0-ab88-20f7382dd24c", + "roleAssignmentNames": { + "deployAMBANetworkChanges": "[guid(concat(parameters('topLevelManagementGroupPrefix'), variables('policyAssignmentNames').ambaNetworkChanges))]" + } + }, + "resources": [ + { + "type": "Microsoft.Authorization/policyAssignments", + "apiVersion": "2020-09-01", + "name": "[variables('policyAssignmentNames').ambaNetworkChanges]", + "location": "[deployment().location]", + "identity": { + "type": "SystemAssigned" + }, + "properties": { + "description": "[variables('policyAssignmentNames').description]", + "displayName": "[variables('policyAssignmentNames').displayName]", + "policyDefinitionId": "[variables('policyDefinitions').deployAMBANetworkChanges]", + "enforcementMode": "[parameters('enforcementMode')]", + "nonComplianceMessages": [ + { + "message": "[replace(variables('nonComplianceMessage').message, parameters('nonComplianceMessagePlaceholder'), variables('nonComplianceMessage')[parameters('enforcementMode')])]" + } + ], + "parameters": "[parameters('policyAssignmentParameters')]", + "metadata": { + "_deployed_by_amba": true + } + } + }, + { + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "name": "[variables('roleAssignmentNames').deployAMBANetworkChanges]", + "dependsOn": [ + "[variables('policyAssignmentNames').ambaNetworkChanges]" + ], + "properties": { + "principalType": "ServicePrincipal", + "roleDefinitionId": "[concat('/providers/Microsoft.Authorization/roleDefinitions/', variables('rbacContributor'))]", + "principalId": "[toLower(reference(concat('/providers/Microsoft.Authorization/policyAssignments/', variables('policyAssignmentNames').ambaNetworkChanges), '2019-09-01', 'Full' ).identity.principalId)]", + "description": "_deployed_by_amba" + } + } + ], + "outputs": {} +} diff --git a/patterns/alz/policyAssignments/DINE-NotificationAssetsAssignment.json b/patterns/alz/policyAssignments/DINE-NotificationAssetsAssignment.json index f68bfbc70..99ed8d174 100644 --- a/patterns/alz/policyAssignments/DINE-NotificationAssetsAssignment.json +++ b/patterns/alz/policyAssignments/DINE-NotificationAssetsAssignment.json @@ -31,7 +31,7 @@ }, "policyAssignmentNames": { "ambaNotificationAssets": "Deploy-AMBA-Notification", - "description": "Initiative to deploy AMBA Notification Assets", + "description": "This initiative deploys Notification Assets for Azure Monitor Baseline Alerts. This includes the setup of an Alert Processing Rule and an Action Group to manage notifications and actions, along with a Notification Suppression Rule to manage alert notifications, as well as a Notification Suppression Rule to control alert notifications.", "displayName": "Deploy Azure Monitor Baseline Alerts - Notification Assets" }, "nonComplianceMessage": { diff --git a/patterns/alz/policyAssignments/DINE-RecoveryServicesAssignment.json b/patterns/alz/policyAssignments/DINE-RecoveryServicesAssignment.json new file mode 100644 index 000000000..940d54319 --- /dev/null +++ b/patterns/alz/policyAssignments/DINE-RecoveryServicesAssignment.json @@ -0,0 +1,88 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-08-01/managementGroupDeploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "topLevelManagementGroupPrefix": { + "type": "string", + "metadata": { + "description": "Provide the ESLZ prefix to your intermediate root management group containing the policy definitions." + } + }, + "enforcementMode": { + "type": "string", + "allowedValues": [ + "Default", + "DoNotEnforce" + ], + "defaultValue": "Default" + }, + "nonComplianceMessagePlaceholder": { + "type": "string", + "defaultValue": "{enforcementMode}" + }, + "policyAssignmentParameters": { + "type": "object", + "defaultValue": {} + } + }, + "variables": { + "policyDefinitions": { + "deployAMBARecoveryServices": "[concat('/providers/Microsoft.Management/managementGroups/', parameters('topLevelManagementGroupPrefix'), '/providers/Microsoft.Authorization/policySetDefinitions/Alerting-RecoveryServices')]" + }, + "policyAssignmentNames": { + "ambaRecoveryServices": "Deploy-AMBA-RecoverySvc", + "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Recovery Services such as Azure Backup, and Azure Site Recovery.", + "displayName": "Deploy Azure Monitor Baseline Alerts for Recovery Services" + }, + "nonComplianceMessage": { + "message": "Alerting {enforcementMode} be deployed to Azure services.", + "Default": "must", + "DoNotEnforce": "should" + }, + "rbacContributor": "b24988ac-6180-42a0-ab88-20f7382dd24c", + "roleAssignmentNames": { + "deployAMBARecoveryServices": "[guid(concat(parameters('topLevelManagementGroupPrefix'), variables('policyAssignmentNames').ambaRecoveryServices))]" + } + }, + "resources": [ + { + "type": "Microsoft.Authorization/policyAssignments", + "apiVersion": "2020-09-01", + "name": "[variables('policyAssignmentNames').ambaRecoveryServices]", + "location": "[deployment().location]", + "identity": { + "type": "SystemAssigned" + }, + "properties": { + "description": "[variables('policyAssignmentNames').description]", + "displayName": "[variables('policyAssignmentNames').displayName]", + "policyDefinitionId": "[variables('policyDefinitions').deployAMBARecoveryServices]", + "enforcementMode": "[parameters('enforcementMode')]", + "nonComplianceMessages": [ + { + "message": "[replace(variables('nonComplianceMessage').message, parameters('nonComplianceMessagePlaceholder'), variables('nonComplianceMessage')[parameters('enforcementMode')])]" + } + ], + "parameters": "[parameters('policyAssignmentParameters')]", + "metadata": { + "_deployed_by_amba": true + } + } + }, + { + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "name": "[variables('roleAssignmentNames').deployAMBARecoveryServices]", + "dependsOn": [ + "[variables('policyAssignmentNames').ambaRecoveryServices]" + ], + "properties": { + "principalType": "ServicePrincipal", + "roleDefinitionId": "[concat('/providers/Microsoft.Authorization/roleDefinitions/', variables('rbacContributor'))]", + "principalId": "[toLower(reference(concat('/providers/Microsoft.Authorization/policyAssignments/', variables('policyAssignmentNames').ambaRecoveryServices), '2019-09-01', 'Full' ).identity.principalId)]", + "description": "_deployed_by_amba" + } + } + ], + "outputs": {} +} diff --git a/patterns/alz/policyAssignments/DINE-ServiceHealthAssignment.json b/patterns/alz/policyAssignments/DINE-ServiceHealthAssignment.json index 7eac98b3d..093dbd3a5 100644 --- a/patterns/alz/policyAssignments/DINE-ServiceHealthAssignment.json +++ b/patterns/alz/policyAssignments/DINE-ServiceHealthAssignment.json @@ -31,7 +31,7 @@ }, "policyAssignmentNames": { "ambaServiceHealth": "Deploy-AMBA-SvcHealth", - "description": "Initiative to deploy AMBA Service Health alerts to Azure services", + "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Service Health Events such as Service issues, Planned maintenance, Health advisories, Security advisories, and Resource health.", "displayName": "Deploy Azure Monitor Baseline Alerts for Service Health" }, "nonComplianceMessage": { diff --git a/patterns/alz/policyAssignments/DINE-LandingZoneAssignment.json b/patterns/alz/policyAssignments/DINE-StorageAssignment.json similarity index 78% rename from patterns/alz/policyAssignments/DINE-LandingZoneAssignment.json rename to patterns/alz/policyAssignments/DINE-StorageAssignment.json index 80f0fe588..cc52bc1d8 100644 --- a/patterns/alz/policyAssignments/DINE-LandingZoneAssignment.json +++ b/patterns/alz/policyAssignments/DINE-StorageAssignment.json @@ -27,12 +27,12 @@ }, "variables": { "policyDefinitions": { - "deployAMBALandingZone": "[concat('/providers/Microsoft.Management/managementGroups/', parameters('topLevelManagementGroupPrefix'), '/providers/Microsoft.Authorization/policySetDefinitions/Alerting-LandingZone')]" + "deployAMBAStorage": "[concat('/providers/Microsoft.Management/managementGroups/', parameters('topLevelManagementGroupPrefix'), '/providers/Microsoft.Authorization/policySetDefinitions/Alerting-Storage')]" }, "policyAssignmentNames": { - "ambaLandingZone": "Deploy-AMBA-LandingZone", - "description": "Initiative to deploy AMBA alerts relevant to the ALZ LandingZone management group", - "displayName": "Deploy Azure Monitor Baseline Alerts for Landing Zone" + "ambaStorage": "Deploy-AMBA-Storage", + "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Storage Services such as Storage accounts.", + "displayName": "Deploy Azure Monitor Baseline Alerts for Storage" }, "nonComplianceMessage": { "message": "Alerting {enforcementMode} be deployed to Azure services.", @@ -41,14 +41,14 @@ }, "rbacContributor": "b24988ac-6180-42a0-ab88-20f7382dd24c", "roleAssignmentNames": { - "deployAMBALandingZone": "[guid(concat(parameters('topLevelManagementGroupPrefix'), variables('policyAssignmentNames').ambaLandingZone))]" + "deployAMBAStorage": "[guid(concat(parameters('topLevelManagementGroupPrefix'), variables('policyAssignmentNames').ambaStorage))]" } }, "resources": [ { "type": "Microsoft.Authorization/policyAssignments", "apiVersion": "2020-09-01", - "name": "[variables('policyAssignmentNames').ambaLandingZone]", + "name": "[variables('policyAssignmentNames').ambaStorage]", "location": "[deployment().location]", "identity": { "type": "SystemAssigned" @@ -56,7 +56,7 @@ "properties": { "description": "[variables('policyAssignmentNames').description]", "displayName": "[variables('policyAssignmentNames').displayName]", - "policyDefinitionId": "[variables('policyDefinitions').deployAMBALandingZone]", + "policyDefinitionId": "[variables('policyDefinitions').deployAMBAStorage]", "enforcementMode": "[parameters('enforcementMode')]", "nonComplianceMessages": [ { @@ -72,14 +72,14 @@ { "type": "Microsoft.Authorization/roleAssignments", "apiVersion": "2022-04-01", - "name": "[variables('roleAssignmentNames').deployAMBALandingZone]", + "name": "[variables('roleAssignmentNames').deployAMBAStorage]", "dependsOn": [ - "[variables('policyAssignmentNames').ambaLandingZone]" + "[variables('policyAssignmentNames').ambaStorage]" ], "properties": { "principalType": "ServicePrincipal", "roleDefinitionId": "[concat('/providers/Microsoft.Authorization/roleDefinitions/', variables('rbacContributor'))]", - "principalId": "[toLower(reference(concat('/providers/Microsoft.Authorization/policyAssignments/', variables('policyAssignmentNames').ambaLandingZone), '2019-09-01', 'Full' ).identity.principalId)]", + "principalId": "[toLower(reference(concat('/providers/Microsoft.Authorization/policyAssignments/', variables('policyAssignmentNames').ambaStorage), '2019-09-01', 'Full' ).identity.principalId)]", "description": "_deployed_by_amba" } } diff --git a/patterns/alz/policyAssignments/DINE-VMAssignment.json b/patterns/alz/policyAssignments/DINE-VMAssignment.json new file mode 100644 index 000000000..f67b135f8 --- /dev/null +++ b/patterns/alz/policyAssignments/DINE-VMAssignment.json @@ -0,0 +1,132 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-08-01/managementGroupDeploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "topLevelManagementGroupPrefix": { + "type": "string", + "metadata": { + "description": "Provide the ESLZ prefix to your intermediate root management group containing the policy definitions." + } + }, + "enforcementMode": { + "type": "string", + "allowedValues": [ + "Default", + "DoNotEnforce" + ], + "defaultValue": "Default" + }, + "nonComplianceMessagePlaceholder": { + "type": "string", + "defaultValue": "{enforcementMode}" + }, + "policyAssignmentParameters": { + "type": "object", + "defaultValue": {} + }, + "scope": { + "type": "String", + "metadata": { + "displayName": "Scope", + "description": "Scope of the policy assignment" + } + }, + "uamiScope": { + "type": "String", + "metadata": { + "displayName": "Platform Scope", + "description": "Scope of the reader role assignment" + }, + "defaultValue": "[parameters('scope')]" + }, + "bringYourOwnUserAssignedManagedIdentity": { + "type": "string", + "defaultValue": "No", + "allowedValues": [ + "Yes", + "No" + ], + "metadata": { + "description": "Specify if you want to bring your own user assigned managed identity for monitoring purpose." + } + } + }, + "variables": { + "policyDefinitions": { + "deployAMBAVM": "[concat('/providers/Microsoft.Management/managementGroups/', parameters('topLevelManagementGroupPrefix'), '/providers/Microsoft.Authorization/policySetDefinitions/Alerting-VM')]" + }, + "policyAssignmentNames": { + "ambaVM": "Deploy-AMBA-VM", + "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Azure Virtual Machines.", + "displayName": "Deploy Azure Monitor Baseline Alerts for Virtual Machines" + }, + "nonComplianceMessage": { + "message": "Alerting {enforcementMode} be deployed to Azure services.", + "Default": "must", + "DoNotEnforce": "should" + }, + "rbacContributor": "b24988ac-6180-42a0-ab88-20f7382dd24c", + "rbacManagedIdentityOperator": "f1a07417-d97a-45cb-824c-7a7467783830", + "roleAssignmentNames": { + "roleAssignmentNameContributor": "[guid(concat(parameters('topLevelManagementGroupPrefix'), variables('policyAssignmentNames').ambaVM,parameters('scope')))]", + "roleAssignmentNameManagedIdentityOperator": "[guid(concat(parameters('toplevelManagementGroupPrefix'),variables('policyAssignmentNames').ambaVM,'-1',parameters('scope')))]" + } + }, + "resources": [ + { + "type": "Microsoft.Authorization/policyAssignments", + "apiVersion": "2020-09-01", + "name": "[variables('policyAssignmentNames').ambaVM]", + "location": "[deployment().location]", + "identity": { + "type": "SystemAssigned" + }, + "properties": { + "description": "[variables('policyAssignmentNames').description]", + "displayName": "[variables('policyAssignmentNames').displayName]", + "policyDefinitionId": "[variables('policyDefinitions').deployAMBAVM]", + "enforcementMode": "[parameters('enforcementMode')]", + "nonComplianceMessages": [ + { + "message": "[replace(variables('nonComplianceMessage').message, parameters('nonComplianceMessagePlaceholder'), variables('nonComplianceMessage')[parameters('enforcementMode')])]" + } + ], + "parameters": "[parameters('policyAssignmentParameters')]", + "metadata": { + "_deployed_by_amba": true + } + } + }, + { + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "name": "[variables('roleAssignmentNames').roleAssignmentNameContributor]", + "dependsOn": [ + "[variables('policyAssignmentNames').ambaVM]" + ], + "properties": { + "principalType": "ServicePrincipal", + "roleDefinitionId": "[concat('/providers/Microsoft.Authorization/roleDefinitions/', variables('rbacContributor'))]", + "principalId": "[toLower(reference(concat('/providers/Microsoft.Authorization/policyAssignments/', variables('policyAssignmentNames').ambaVM), '2019-09-01', 'Full' ).identity.principalId)]", + "description": "_deployed_by_amba" + } + }, + { + "condition": "[and(not(equals(parameters('uamiScope'), parameters('scope'))), equals(parameters('bringYourOwnUserAssignedManagedIdentity'), 'No'))]", + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "name": "[variables('roleAssignmentNames').roleAssignmentNameManagedIdentityOperator]", + "scope": "[tenantResourceId('Microsoft.Management/managementGroups/', parameters('uamiScope'))]", + "dependsOn": [ + "[variables('policyAssignmentNames').ambaVM]" + ], + "properties": { + "principalType": "ServicePrincipal", + "roleDefinitionId": "[concat('/providers/Microsoft.Authorization/roleDefinitions/', variables('rbacManagedIdentityOperator'))]", + "principalId": "[toLower(reference(concat('/providers/Microsoft.Authorization/policyAssignments/', variables('policyAssignmentNames').ambaVM), '2019-09-01', 'Full' ).identity.principalId)]", + "description": "_deployed_by_amba" + } + } + ], + "outputs": {} +} diff --git a/patterns/alz/policyAssignments/DINE-WebAssignment.json b/patterns/alz/policyAssignments/DINE-WebAssignment.json new file mode 100644 index 000000000..6a146b453 --- /dev/null +++ b/patterns/alz/policyAssignments/DINE-WebAssignment.json @@ -0,0 +1,88 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-08-01/managementGroupDeploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "topLevelManagementGroupPrefix": { + "type": "string", + "metadata": { + "description": "Provide the ESLZ prefix to your intermediate root management group containing the policy definitions." + } + }, + "enforcementMode": { + "type": "string", + "allowedValues": [ + "Default", + "DoNotEnforce" + ], + "defaultValue": "Default" + }, + "nonComplianceMessagePlaceholder": { + "type": "string", + "defaultValue": "{enforcementMode}" + }, + "policyAssignmentParameters": { + "type": "object", + "defaultValue": {} + } + }, + "variables": { + "policyDefinitions": { + "deployAMBAWeb": "[concat('/providers/Microsoft.Management/managementGroups/', parameters('topLevelManagementGroupPrefix'), '/providers/Microsoft.Authorization/policySetDefinitions/Alerting-Web')]" + }, + "policyAssignmentNames": { + "ambaWeb": "Deploy-AMBA-Web", + "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Web Services such as App Services.", + "displayName": "Deploy Azure Monitor Baseline Alerts for Web" + }, + "nonComplianceMessage": { + "message": "Alerting {enforcementMode} be deployed to Azure services.", + "Default": "must", + "DoNotEnforce": "should" + }, + "rbacContributor": "b24988ac-6180-42a0-ab88-20f7382dd24c", + "roleAssignmentNames": { + "deployAMBAWeb": "[guid(concat(parameters('topLevelManagementGroupPrefix'), variables('policyAssignmentNames').ambaWeb))]" + } + }, + "resources": [ + { + "type": "Microsoft.Authorization/policyAssignments", + "apiVersion": "2020-09-01", + "name": "[variables('policyAssignmentNames').ambaWeb]", + "location": "[deployment().location]", + "identity": { + "type": "SystemAssigned" + }, + "properties": { + "description": "[variables('policyAssignmentNames').description]", + "displayName": "[variables('policyAssignmentNames').displayName]", + "policyDefinitionId": "[variables('policyDefinitions').deployAMBAWeb]", + "enforcementMode": "[parameters('enforcementMode')]", + "nonComplianceMessages": [ + { + "message": "[replace(variables('nonComplianceMessage').message, parameters('nonComplianceMessagePlaceholder'), variables('nonComplianceMessage')[parameters('enforcementMode')])]" + } + ], + "parameters": "[parameters('policyAssignmentParameters')]", + "metadata": { + "_deployed_by_amba": true + } + } + }, + { + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "name": "[variables('roleAssignmentNames').deployAMBAWeb]", + "dependsOn": [ + "[variables('policyAssignmentNames').ambaWeb]" + ], + "properties": { + "principalType": "ServicePrincipal", + "roleDefinitionId": "[concat('/providers/Microsoft.Authorization/roleDefinitions/', variables('rbacContributor'))]", + "principalId": "[toLower(reference(concat('/providers/Microsoft.Authorization/policyAssignments/', variables('policyAssignmentNames').ambaWeb), '2019-09-01', 'Full' ).identity.principalId)]", + "description": "_deployed_by_amba" + } + } + ], + "outputs": {} +} diff --git a/patterns/alz/policyDefinitions/policies-Automation.json b/patterns/alz/policyDefinitions/policies-Automation.json new file mode 100644 index 000000000..e5c14c615 --- /dev/null +++ b/patterns/alz/policyDefinitions/policies-Automation.json @@ -0,0 +1,222 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-08-01/managementGroupDeploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.29.47.4906", + "templateHash": "3220074555185136320" + } + }, + "parameters": { + "topLevelManagementGroupPrefix": { + "type": "string", + "defaultValue": "alz", + "metadata": { + "message": "The JSON version of this file is programatically generated from Bicep. PLEASE DO NOT UPDATE MANUALLY!!", + "description": "Provide a prefix (unique at tenant-scope) for the Management Group hierarchy and other resources created as part of an Azure landing zone. DEFAULT VALUE = \"alz\"" + } + }, + "location": { + "type": "string", + "defaultValue": "[deployment().location]", + "metadata": { + "description": "Optionally set the deployment location for policies with Deploy If Not Exists effect. DEFAULT VALUE = \"deployment().location\"" + } + }, + "scope": { + "type": "string", + "defaultValue": "[tenantResourceId('Microsoft.Management/managementGroups', parameters('topLevelManagementGroupPrefix'))]", + "metadata": { + "description": "Optionally set the scope for custom Policy Definitions used in Policy Set Definitions (Initiatives). Must be one of '/', '/subscriptions/id' or '/providers/Microsoft.Management/managementGroups/id'. DEFAULT VALUE = '/providers/Microsoft.Management/managementGroups/${topLevelManagementGroupPrefix}'" + } + } + }, + "variables": { + "copy": [ + { + "name": "processPolicyDefinitionsAll", + "count": "[length(variables('loadPolicyDefinitions').All)]", + "input": "[replace(replace(variables('loadPolicyDefinitions').All[copyIndex('processPolicyDefinitionsAll')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" + }, + { + "name": "processPolicyDefinitionsAzureCloud", + "count": "[length(variables('loadPolicyDefinitions').AzureCloud)]", + "input": "[replace(replace(variables('loadPolicyDefinitions').AzureCloud[copyIndex('processPolicyDefinitionsAzureCloud')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" + }, + { + "name": "processPolicyDefinitionsAzureChinaCloud", + "count": "[length(variables('loadPolicyDefinitions').AzureChinaCloud)]", + "input": "[replace(replace(variables('loadPolicyDefinitions').AzureChinaCloud[copyIndex('processPolicyDefinitionsAzureChinaCloud')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" + }, + { + "name": "processPolicyDefinitionsAzureUSGovernment", + "count": "[length(variables('loadPolicyDefinitions').AzureUSGovernment)]", + "input": "[replace(replace(variables('loadPolicyDefinitions').AzureUSGovernment[copyIndex('processPolicyDefinitionsAzureUSGovernment')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" + }, + { + "name": "processPolicySetDefinitionsAll", + "count": "[length(variables('loadPolicySetDefinitions').All)]", + "input": "[replace(variables('loadPolicySetDefinitions').All[copyIndex('processPolicySetDefinitionsAll')], variables('templateVars').scope, parameters('scope'))]" + }, + { + "name": "processPolicySetDefinitionsAzureCloud", + "count": "[length(variables('loadPolicySetDefinitions').AzureCloud)]", + "input": "[replace(variables('loadPolicySetDefinitions').AzureCloud[copyIndex('processPolicySetDefinitionsAzureCloud')], variables('templateVars').scope, parameters('scope'))]" + }, + { + "name": "processPolicySetDefinitionsAzureChinaCloud", + "count": "[length(variables('loadPolicySetDefinitions').AzureChinaCloud)]", + "input": "[replace(variables('loadPolicySetDefinitions').AzureChinaCloud[copyIndex('processPolicySetDefinitionsAzureChinaCloud')], variables('templateVars').scope, parameters('scope'))]" + }, + { + "name": "processPolicySetDefinitionsAzureUSGovernment", + "count": "[length(variables('loadPolicySetDefinitions').AzureUSGovernment)]", + "input": "[replace(variables('loadPolicySetDefinitions').AzureUSGovernment[copyIndex('processPolicySetDefinitionsAzureUSGovernment')], variables('templateVars').scope, parameters('scope'))]" + }, + { + "name": "policyDefinitionsAll", + "count": "[length(variables('processPolicyDefinitionsAll'))]", + "input": "[json(variables('processPolicyDefinitionsAll')[copyIndex('policyDefinitionsAll')])]" + }, + { + "name": "policyDefinitionsAzureCloud", + "count": "[length(variables('processPolicyDefinitionsAzureCloud'))]", + "input": "[json(variables('processPolicyDefinitionsAzureCloud')[copyIndex('policyDefinitionsAzureCloud')])]" + }, + { + "name": "policyDefinitionsAzureChinaCloud", + "count": "[length(variables('processPolicyDefinitionsAzureChinaCloud'))]", + "input": "[json(variables('processPolicyDefinitionsAzureChinaCloud')[copyIndex('policyDefinitionsAzureChinaCloud')])]" + }, + { + "name": "policyDefinitionsAzureUSGovernment", + "count": "[length(variables('processPolicyDefinitionsAzureUSGovernment'))]", + "input": "[json(variables('processPolicyDefinitionsAzureUSGovernment')[copyIndex('policyDefinitionsAzureUSGovernment')])]" + }, + { + "name": "policySetDefinitionsAll", + "count": "[length(variables('processPolicySetDefinitionsAll'))]", + "input": "[json(variables('processPolicySetDefinitionsAll')[copyIndex('policySetDefinitionsAll')])]" + }, + { + "name": "policySetDefinitionsAzureCloud", + "count": "[length(variables('processPolicySetDefinitionsAzureCloud'))]", + "input": "[json(variables('processPolicySetDefinitionsAzureCloud')[copyIndex('policySetDefinitionsAzureCloud')])]" + }, + { + "name": "policySetDefinitionsAzureChinaCloud", + "count": "[length(variables('processPolicySetDefinitionsAzureChinaCloud'))]", + "input": "[json(variables('processPolicySetDefinitionsAzureChinaCloud')[copyIndex('policySetDefinitionsAzureChinaCloud')])]" + }, + { + "name": "policySetDefinitionsAzureUSGovernment", + "count": "[length(variables('processPolicySetDefinitionsAzureUSGovernment'))]", + "input": "[json(variables('processPolicySetDefinitionsAzureUSGovernment')[copyIndex('policySetDefinitionsAzureUSGovernment')])]" + } + ], + "$fxv#0": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_AA_TotalJob_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Automation Account TotalJob Alert\",\n \"description\": \"Policy to audit/deploy Automation Account TotalJob Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Automation\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT1M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"0\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Automation/automationAccounts\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Automation/automationAccounts\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"TotalJob\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Automation/automationAccounts/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].operator\",\n \"equals\": \"GreaterThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-TotalJob-threshold-override_'), field('tags._amba-TotalJob-threshold-override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-TotalJob')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for Automation Account TotalJob Alert\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"TotalJob\",\n \"metricNamespace\": \"Microsoft.Automation/automationAccounts\",\n \"metricName\": \"TotalJob\",\n \"dimensions\": [\n {\n \"name\": \"Status\",\n \"operator\": \"Exclude\",\n \"values\": [\n \"Completed\"\n ]\n }\n ],\n \"operator\": \"GreaterThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-TotalJob-threshold-override_'), field('tags._amba-TotalJob-threshold-override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "cloudEnv": "[environment().name]", + "defaultDeploymentLocationByCloudType": { + "AzureCloud": "northeurope", + "AzureChinaCloud": "chinaeast2", + "AzureUSGovernment": "usgovvirginia" + }, + "templateVars": { + "scope": "/providers/Microsoft.Management/managementGroups/contoso", + "defaultDeploymentLocation": "\"location\": \"northeurope\"", + "localizedDeploymentLocation": "[format('\"location\": \"{0}\"', variables('defaultDeploymentLocationByCloudType')[variables('cloudEnv')])]" + }, + "targetDeploymentLocationByCloudType": { + "AzureCloud": "[coalesce(parameters('location'), 'northeurope')]", + "AzureChinaCloud": "[coalesce(parameters('location'), 'chinaeast2')]", + "AzureUSGovernment": "[coalesce(parameters('location'), 'usgovvirginia')]" + }, + "deploymentLocation": "[format('\"location\": \"{0}\"', variables('targetDeploymentLocationByCloudType')[variables('cloudEnv')])]", + "loadPolicyDefinitions": { + "All": [ + "[variables('$fxv#0')]" + ], + "AzureCloud": [], + "AzureChinaCloud": [], + "AzureUSGovernment": [] + }, + "loadPolicySetDefinitions": { + "All": [], + "AzureCloud": [], + "AzureChinaCloud": [], + "AzureUSGovernment": [] + }, + "policyDefinitionsByCloudType": { + "All": "[variables('policyDefinitionsAll')]", + "AzureCloud": "[variables('policyDefinitionsAzureCloud')]", + "AzureChinaCloud": "[variables('policyDefinitionsAzureChinaCloud')]", + "AzureUSGovernment": "[variables('policyDefinitionsAzureUSGovernment')]" + }, + "policySetDefinitionsByCloudType": { + "All": "[variables('policySetDefinitionsAll')]", + "AzureCloud": "[variables('policySetDefinitionsAzureCloud')]", + "AzureChinaCloud": "[variables('policySetDefinitionsAzureChinaCloud')]", + "AzureUSGovernment": "[variables('policySetDefinitionsAzureUSGovernment')]" + }, + "policyDefinitions": "[concat(variables('policyDefinitionsByCloudType').All, variables('policyDefinitionsByCloudType')[variables('cloudEnv')])]", + "policySetDefinitions": "[concat(variables('policySetDefinitionsByCloudType').All, variables('policySetDefinitionsByCloudType')[variables('cloudEnv')])]" + }, + "resources": [ + { + "copy": { + "name": "PolicyDefinitions", + "count": "[length(variables('policyDefinitions'))]" + }, + "type": "Microsoft.Authorization/policyDefinitions", + "apiVersion": "2020-09-01", + "name": "[variables('policyDefinitions')[copyIndex()].name]", + "properties": { + "description": "[variables('policyDefinitions')[copyIndex()].properties.description]", + "displayName": "[variables('policyDefinitions')[copyIndex()].properties.displayName]", + "metadata": "[variables('policyDefinitions')[copyIndex()].properties.metadata]", + "mode": "[variables('policyDefinitions')[copyIndex()].properties.mode]", + "parameters": "[variables('policyDefinitions')[copyIndex()].properties.parameters]", + "policyType": "[variables('policyDefinitions')[copyIndex()].properties.policyType]", + "policyRule": "[variables('policyDefinitions')[copyIndex()].properties.policyRule]" + } + }, + { + "copy": { + "name": "PolicySetDefinitions", + "count": "[length(variables('policySetDefinitions'))]" + }, + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2020-09-01", + "name": "[variables('policySetDefinitions')[copyIndex()].name]", + "properties": { + "description": "[variables('policySetDefinitions')[copyIndex()].properties.description]", + "displayName": "[variables('policySetDefinitions')[copyIndex()].properties.displayName]", + "metadata": "[variables('policySetDefinitions')[copyIndex()].properties.metadata]", + "parameters": "[variables('policySetDefinitions')[copyIndex()].properties.parameters]", + "policyType": "[variables('policySetDefinitions')[copyIndex()].properties.policyType]", + "policyDefinitions": "[variables('policySetDefinitions')[copyIndex()].properties.policyDefinitions]", + "policyDefinitionGroups": "[variables('policySetDefinitions')[copyIndex()].properties.policyDefinitionGroups]" + }, + "dependsOn": [ + "PolicyDefinitions" + ] + } + ], + "outputs": { + "policyDefinitionNames": { + "type": "array", + "copy": { + "count": "[length(variables('policyDefinitions'))]", + "input": "[variables('policyDefinitions')[copyIndex()].name]" + } + }, + "policySetDefinitionNames": { + "type": "array", + "copy": { + "count": "[length(variables('policySetDefinitions'))]", + "input": "[variables('policySetDefinitions')[copyIndex()].name]" + } + } + } +} \ No newline at end of file diff --git a/patterns/alz/policyDefinitions/policies-Compute.json b/patterns/alz/policyDefinitions/policies-Compute.json new file mode 100644 index 000000000..8d5eeb836 --- /dev/null +++ b/patterns/alz/policyDefinitions/policies-Compute.json @@ -0,0 +1,2637 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-08-01/managementGroupDeploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.29.47.4906", + "templateHash": "7212493230979649519" + } + }, + "parameters": { + "topLevelManagementGroupPrefix": { + "type": "string", + "defaultValue": "alz", + "metadata": { + "message": "The JSON version of this file is programatically generated from Bicep. PLEASE DO NOT UPDATE MANUALLY!!", + "description": "Provide a prefix (unique at tenant-scope) for the Management Group hierarchy and other resources created as part of an Azure landing zone. DEFAULT VALUE = \"alz\"" + } + }, + "location": { + "type": "string", + "defaultValue": "[deployment().location]", + "metadata": { + "description": "Optionally set the deployment location for policies with Deploy If Not Exists effect. DEFAULT VALUE = \"deployment().location\"" + } + }, + "scope": { + "type": "string", + "defaultValue": "[tenantResourceId('Microsoft.Management/managementGroups', parameters('topLevelManagementGroupPrefix'))]", + "metadata": { + "description": "Optionally set the scope for custom Policy Definitions used in Policy Set Definitions (Initiatives). Must be one of '/', '/subscriptions/id' or '/providers/Microsoft.Management/managementGroups/id'. DEFAULT VALUE = '/providers/Microsoft.Management/managementGroups/${topLevelManagementGroupPrefix}'" + } + } + }, + "variables": { + "copy": [ + { + "name": "processPolicyDefinitionsAll", + "count": "[length(variables('loadPolicyDefinitions').All)]", + "input": "[replace(replace(variables('loadPolicyDefinitions').All[copyIndex('processPolicyDefinitionsAll')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" + }, + { + "name": "processPolicyDefinitionsAzureCloud", + "count": "[length(variables('loadPolicyDefinitions').AzureCloud)]", + "input": "[replace(replace(variables('loadPolicyDefinitions').AzureCloud[copyIndex('processPolicyDefinitionsAzureCloud')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" + }, + { + "name": "processPolicyDefinitionsAzureChinaCloud", + "count": "[length(variables('loadPolicyDefinitions').AzureChinaCloud)]", + "input": "[replace(replace(variables('loadPolicyDefinitions').AzureChinaCloud[copyIndex('processPolicyDefinitionsAzureChinaCloud')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" + }, + { + "name": "processPolicyDefinitionsAzureUSGovernment", + "count": "[length(variables('loadPolicyDefinitions').AzureUSGovernment)]", + "input": "[replace(replace(variables('loadPolicyDefinitions').AzureUSGovernment[copyIndex('processPolicyDefinitionsAzureUSGovernment')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" + }, + { + "name": "processPolicySetDefinitionsAll", + "count": "[length(variables('loadPolicySetDefinitions').All)]", + "input": "[replace(variables('loadPolicySetDefinitions').All[copyIndex('processPolicySetDefinitionsAll')], variables('templateVars').scope, parameters('scope'))]" + }, + { + "name": "processPolicySetDefinitionsAzureCloud", + "count": "[length(variables('loadPolicySetDefinitions').AzureCloud)]", + "input": "[replace(variables('loadPolicySetDefinitions').AzureCloud[copyIndex('processPolicySetDefinitionsAzureCloud')], variables('templateVars').scope, parameters('scope'))]" + }, + { + "name": "processPolicySetDefinitionsAzureChinaCloud", + "count": "[length(variables('loadPolicySetDefinitions').AzureChinaCloud)]", + "input": "[replace(variables('loadPolicySetDefinitions').AzureChinaCloud[copyIndex('processPolicySetDefinitionsAzureChinaCloud')], variables('templateVars').scope, parameters('scope'))]" + }, + { + "name": "processPolicySetDefinitionsAzureUSGovernment", + "count": "[length(variables('loadPolicySetDefinitions').AzureUSGovernment)]", + "input": "[replace(variables('loadPolicySetDefinitions').AzureUSGovernment[copyIndex('processPolicySetDefinitionsAzureUSGovernment')], variables('templateVars').scope, parameters('scope'))]" + }, + { + "name": "policyDefinitionsAll", + "count": "[length(variables('processPolicyDefinitionsAll'))]", + "input": "[json(variables('processPolicyDefinitionsAll')[copyIndex('policyDefinitionsAll')])]" + }, + { + "name": "policyDefinitionsAzureCloud", + "count": "[length(variables('processPolicyDefinitionsAzureCloud'))]", + "input": "[json(variables('processPolicyDefinitionsAzureCloud')[copyIndex('policyDefinitionsAzureCloud')])]" + }, + { + "name": "policyDefinitionsAzureChinaCloud", + "count": "[length(variables('processPolicyDefinitionsAzureChinaCloud'))]", + "input": "[json(variables('processPolicyDefinitionsAzureChinaCloud')[copyIndex('policyDefinitionsAzureChinaCloud')])]" + }, + { + "name": "policyDefinitionsAzureUSGovernment", + "count": "[length(variables('processPolicyDefinitionsAzureUSGovernment'))]", + "input": "[json(variables('processPolicyDefinitionsAzureUSGovernment')[copyIndex('policyDefinitionsAzureUSGovernment')])]" + }, + { + "name": "policySetDefinitionsAll", + "count": "[length(variables('processPolicySetDefinitionsAll'))]", + "input": "[json(variables('processPolicySetDefinitionsAll')[copyIndex('policySetDefinitionsAll')])]" + }, + { + "name": "policySetDefinitionsAzureCloud", + "count": "[length(variables('processPolicySetDefinitionsAzureCloud'))]", + "input": "[json(variables('processPolicySetDefinitionsAzureCloud')[copyIndex('policySetDefinitionsAzureCloud')])]" + }, + { + "name": "policySetDefinitionsAzureChinaCloud", + "count": "[length(variables('processPolicySetDefinitionsAzureChinaCloud'))]", + "input": "[json(variables('processPolicySetDefinitionsAzureChinaCloud')[copyIndex('policySetDefinitionsAzureChinaCloud')])]" + }, + { + "name": "policySetDefinitionsAzureUSGovernment", + "count": "[length(variables('processPolicySetDefinitionsAzureUSGovernment'))]", + "input": "[json(variables('processPolicySetDefinitionsAzureUSGovernment')[copyIndex('policySetDefinitionsAzureUSGovernment')])]" + } + ], + "$fxv#0": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VM_dataDiskReadLatency_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VM Data Disk Read Latency Alert\",\n \"description\": \"Policy to audit/deploy VM dataDiskReadLatency Alert\",\n \"metadata\": {\n \"version\": \"1.4.0\",\n \"category\": \"Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"30\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Compute/virtualMachines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-VMHighDataDiskReadLatencyAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadLatencyMs-Data-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\", \\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadLatencyMs-Data-threshold-override_\\\", tostring(tags.[\\\"_amba-ReadLatencyMs-Data-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"VMdataDiskReadLatencyAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-VMHighDataDiskReadLatencyAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-VMHighDataDiskReadLatencyAlert')]\",\n \"description\": \"Log Alert for Virtual Machine dataDiskReadLatency\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.Compute/virtualMachines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadLatencyMs-Data-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\", \\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadLatencyMs-Data-threshold-override_\\\", tostring(tags.[\\\"_amba-ReadLatencyMs-Data-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"Disk\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#1": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VM_dataDiskSpace_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VM Data Disk Space Alert\",\n \"description\": \"Policy to audit/deploy VM data Disk Space Alert\",\n \"metadata\": {\n \"version\": \"1.4.0\",\n \"category\": \"Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"10\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Compute/virtualMachines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-VMLowDataDiskSpaceAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-FreeSpacePercentage-Data-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\", \\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-FreeSpacePercentage-Data-threshold-override_\\\", tostring(tags.[\\\"_amba-FreeSpacePercentage-Data-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"VMdataDiskSpaceAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-VMLowDataDiskSpaceAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-VMLowDataDiskSpaceAlert')]\",\n \"description\": \"Log Alert for Virtual Machine dataDiskSpace\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.Compute/virtualMachines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-FreeSpacePercentage-Data-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\", \\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-FreeSpacePercentage-Data-threshold-override_\\\", tostring(tags.[\\\"_amba-FreeSpacePercentage-Data-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"Disk\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#10": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VM_Memory_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VM Memory Alert\",\n \"description\": \"Policy to audit/deploy VM Memory Alert\",\n \"metadata\": {\n \"version\": \"1.4.0\",\n \"category\": \"Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"10\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Compute/virtualMachines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-VMLowMemoryAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-AvailableMemoryPercentage-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Memory\\\" and Name == \\\"AvailableMB\\\" | extend TotalMemory = toreal(todynamic(Tags)[\\\"vm.azm.ms/memorySizeMB\\\"]) | extend AvailableMemoryPercentage = (toreal(Val) / TotalMemory) * 100.0 | summarize AggregatedValue = avg(AvailableMemoryPercentage) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-AvailableMemoryPercentage-threshold-override_\\\", tostring(tags.[\\\"_amba-AvailableMemoryPercentage-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"VMMemoryAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-VMLowMemoryAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-VMLowMemoryAlert')]\",\n \"description\": \"Log Alert for Virtual Machine Memory\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.Compute/virtualMachines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-AvailableMemoryPercentage-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Memory\\\" and Name == \\\"AvailableMB\\\" | extend TotalMemory = toreal(todynamic(Tags)[\\\"vm.azm.ms/memorySizeMB\\\"]) | extend AvailableMemoryPercentage = (toreal(Val) / TotalMemory) * 100.0 | summarize AggregatedValue = avg(AvailableMemoryPercentage) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-AvailableMemoryPercentage-threshold-override_\\\", tostring(tags.[\\\"_amba-AvailableMemoryPercentage-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#11": { + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "name": "Alerting-VM", + "properties": { + "displayName": "Deploy Azure Monitor Baseline Alerts for Virtual Machines", + "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Azure Virtual Machines.", + "metadata": { + "version": "1.0.0", + "category": "Monitoring", + "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", + "alzCloudEnvironments": [ + "AzureCloud" + ], + "_deployed_by_amba": true + }, + "parameters": { + "ALZMonitorResourceGroupName": { + "type": "String", + "defaultValue": "ALZ-Monitoring-RG", + "metadata": { + "displayName": "ALZ Monitor Resource Group Name", + "description": "Name of the resource group where the ALZ Monitor resources will be deployed" + } + }, + "ALZMonitorResourceGroupTags": { + "type": "Object", + "defaultValue": { + "_deployed_by_alz_monitor": true + }, + "metadata": { + "displayName": "ALZ Monitor Resource Group Tags", + "description": "Tags for the resource group where the ALZ Monitor resources will be deployed" + } + }, + "ALZMonitorResourceGroupLocation": { + "type": "String", + "defaultValue": "centralus", + "metadata": { + "displayName": "ALZ Monitor Resource Group Location", + "description": "Location of the resource group where the ALZ Monitor resources will be deployed" + } + }, + "ALZMonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": "MonitorDisable" + }, + "ALZMonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] + }, + "ALZUserAssignedManagedIdentityName": { + "type": "string", + "defaultValue": "id-AMBA-ARG-Reader-001", + "metadata": { + "description": "The name of the user assigned managed identity to be created for monitoring purpose.", + "displayName": "Name of the user assigned managed identity to be created." + } + }, + "ALZManagementSubscriptionId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "The subscription ID of the management subscription where the user assigned managed identity will be created." + } + }, + "BYOUserAssignedManagedIdentityResourceId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "The resource Id of the user assigned managed identity provided by the customer.", + "displayName": "Customer defined User Assigned managed Identity resource Id." + } + }, + "VMHeartBeatRGAlertSeverity": { + "type": "String", + "defaultValue": "1", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "VM Heart Beat RG Alert Severity", + "description": "Severity of the alert for VM Heart Beat RG" + } + }, + "VMHeartBeatRGWindowSize": { + "type": "string", + "defaultValue": "PT6H", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "VM Heart Beat RG Window Size", + "description": "Window size for the alert" + } + }, + "VMHeartBeatRGEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "VM Heart Beat RG Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VMHeartBeatRGAutoMitigate": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Heart Beat RG Auto Mitigate", + "description": "Auto Mitigate for the alert" + } + }, + "VMHeartBeatRGAutoResolve": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Heart Beat RG Auto Resolve", + "description": "Auto Resolve for the alert" + } + }, + "VMHeartBeatRGAutoResolveTime": { + "type": "string", + "defaultValue": "00:10:00", + "metadata": { + "displayName": "VM Heart Beat RG Auto Resolve Time", + "description": "Auto Resolve Time for the alert" + } + }, + "VMHeartBeatRGPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "VM Heart Beat RG Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "VMHeartBeatRGAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Heart Beat RG Alert State", + "description": "Alert state for the alert" + } + }, + "VMHeartBeatRGThreshold": { + "type": "string", + "defaultValue": "10", + "metadata": { + "displayName": "VM Heart Beat RG Threshold", + "description": "Threshold for the alert" + } + }, + "VMHeartBeatRGOperator": { + "type": "string", + "defaultValue": "GreaterThan", + "allowedValues": [ + "GreaterThan" + ], + "metadata": { + "displayName": "VM Heart Beat RG Operator", + "description": "Operator for the alert" + } + }, + "VMHeartBeatRGTimeAggregation": { + "type": "string", + "defaultValue": "Count", + "allowedValues": [ + "Count" + ], + "metadata": { + "displayName": "VM Heart Beat RG Time Aggregation", + "description": "Time Aggregation for the alert" + } + }, + "VMHeartBeatRGComputersToInclude": { + "type": "array", + "defaultValue": [ + "*" + ], + "metadata": { + "displayName": "VM Heart Beat RG Computers To Include", + "description": "Computers To Include for the alert" + } + }, + "VMHeartBeatRGFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM Heart Beat RG Failing Periods", + "description": "Failing Periods for the alert" + } + }, + "VMNetworkInAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "VM Network In Alert Severity", + "description": "Severity of the alert for VM Network In" + } + }, + "VMNetworkInWindowSize": { + "type": "string", + "defaultValue": "PT15M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "VM Network In Window Size", + "description": "Window size for the alert" + } + }, + "VMNetworkInEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "VM Network In Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VMNetworkInAutoMitigate": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Network In Auto Mitigate", + "description": "Auto Mitigate for the alert" + } + }, + "VMNetworkInAutoResolve": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Network In Auto Resolve", + "description": "Auto Resolve for the alert" + } + }, + "VMNetworkInAutoResolveTime": { + "type": "string", + "defaultValue": "00:10:00", + "metadata": { + "displayName": "VM Network In Auto Resolve Time", + "description": "Auto Resolve Time for the alert" + } + }, + "VMNetworkInPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "VM Network In Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "VMNetworkInAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Network In Alert State", + "description": "Alert state for the alert" + } + }, + "VMNetworkInThreshold": { + "type": "string", + "defaultValue": "10000000", + "metadata": { + "displayName": "VM Network In Threshold", + "description": "Threshold for the alert" + } + }, + "VMNetworkInOperator": { + "type": "string", + "defaultValue": "GreaterThan", + "allowedValues": [ + "GreaterThan" + ], + "metadata": { + "displayName": "VM Network In Operator", + "description": "Operator for the alert" + } + }, + "VMNetworkInTimeAggregation": { + "type": "string", + "defaultValue": "Count", + "allowedValues": [ + "Count" + ], + "metadata": { + "displayName": "VM Network In Time Aggregation", + "description": "Time Aggregation for the alert" + } + }, + "VMNetworkInEvaluationPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM Network In Evaluation Periods", + "description": "Evaluation Periods for the alert" + } + }, + "VMNetworkInFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM Network In Failing Periods", + "description": "Failing Periods for the alert" + } + }, + "VMNetworkInComputersToInclude": { + "type": "array", + "defaultValue": [ + "*" + ], + "metadata": { + "displayName": "VM Network In Computers To Include", + "description": "Computers To Include for the alert" + } + }, + "VMNetworkOutAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "VM Network Out Alert Severity", + "description": "Severity of the alert for VM Network Out" + } + }, + "VMNetworkOutWindowSize": { + "type": "string", + "defaultValue": "PT15M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "VM Network Out Window Size", + "description": "Window size for the alert" + } + }, + "VMNetworkOutEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "VM Network Out Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VMNetworkOutAutoMitigate": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Network Out Auto Mitigate", + "description": "Auto Mitigate for the alert" + } + }, + "VMNetworkOutAutoResolve": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Network Out Auto Resolve", + "description": "Auto Resolve for the alert" + } + }, + "VMNetworkOutAutoResolveTime": { + "type": "string", + "defaultValue": "00:10:00", + "metadata": { + "displayName": "VM Network Out Auto Resolve Time", + "description": "Auto Resolve Time for the alert" + } + }, + "VMNetworkOutPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "VM Network Out Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "VMNetworkOutAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Network Out Alert State", + "description": "Alert state for the alert, true will enable the alert, false will disable the alert" + } + }, + "VMNetworkOutThreshold": { + "type": "string", + "defaultValue": "10000000", + "metadata": { + "displayName": "VM Network Out Threshold", + "description": "Threshold for the alert" + } + }, + "VMNetworkOutOperator": { + "type": "string", + "defaultValue": "GreaterThan", + "allowedValues": [ + "GreaterThan" + ], + "metadata": { + "displayName": "VM Network Out Operator", + "description": "Operator for the alert" + } + }, + "VMNetworkOutTimeAggregation": { + "type": "string", + "defaultValue": "Count", + "allowedValues": [ + "Count" + ], + "metadata": { + "displayName": "VM Network Out Time Aggregation", + "description": "Time Aggregation for the alert" + } + }, + "VMNetworkOutEvaluationPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM Network Out Evaluation Periods", + "description": "Evaluation Periods for the alert" + } + }, + "VMNetworkOutFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM Network Out Failing Periods", + "description": "Failing Periods for the alert" + } + }, + "VMNetworkOutComputersToInclude": { + "type": "array", + "defaultValue": [ + "*" + ], + "metadata": { + "displayName": "VM Network Out Computers To Include", + "description": "Computers To Include for the alert" + } + }, + "VMOSDiskReadLatencyAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "VM OS Disk Read Latency Alert Severity", + "description": "Severity of the alert for VM OS Disk Read Latency" + } + }, + "VMOSDiskReadLatencyWindowSize": { + "type": "string", + "defaultValue": "PT15M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "VM OS Disk Read Latency Window Size", + "description": "Window size for the alert" + } + }, + "VMOSDiskReadLatencyEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "VM OS Disk Read Latency Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VMOSDiskReadLatencyAutoMitigate": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM OS Disk Read Latency Auto Mitigate", + "description": "Auto Mitigate for the alert" + } + }, + "VMOSDiskReadLatencyAutoResolve": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM OS Disk Read Latency Auto Resolve", + "description": "Auto Resolve for the alert" + } + }, + "VMOSDiskReadLatencyAutoResolveTime": { + "type": "string", + "defaultValue": "00:10:00", + "metadata": { + "displayName": "VM OS Disk Read Latency Auto Resolve Time", + "description": "Auto Resolve Time for the alert" + } + }, + "VMOSDiskReadLatencyPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "VM OS Disk Read Latency Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "VMOSDiskReadLatencyAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM OS Disk Read Latency Alert State", + "description": "Alert state for the alert, true will enable the alert, false will disable the alert" + } + }, + "VMOSDiskReadLatencyThreshold": { + "type": "string", + "defaultValue": "30", + "metadata": { + "displayName": "VM OS Disk Read Latency Threshold", + "description": "Threshold for the alert" + } + }, + "VMOSDiskReadLatencyOperator": { + "type": "string", + "defaultValue": "GreaterThan", + "allowedValues": [ + "GreaterThan" + ], + "metadata": { + "displayName": "VM OS Disk Read Latency Operator", + "description": "Operator for the alert" + } + }, + "VMOSDiskReadLatencyTimeAggregation": { + "type": "string", + "defaultValue": "Count", + "allowedValues": [ + "Count" + ], + "metadata": { + "displayName": "VM OS Disk Read Latency Time Aggregation", + "description": "Time Aggregation for the alert" + } + }, + "VMOSDiskReadLatencyEvaluationPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM OS Disk Read Latency Evaluation Periods", + "description": "Evaluation Periods for the alert" + } + }, + "VMOSDiskReadLatencyFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM OS Disk Read Latency Failing Periods", + "description": "Failing Periods for the alert" + } + }, + "VMOSDiskReadLatencyComputersToInclude": { + "type": "array", + "defaultValue": [ + "*" + ], + "metadata": { + "displayName": "VM OS Disk Read Latency Computers To Include", + "description": "Computers To Include for the alert" + } + }, + "VMOSDiskWriteLatencyAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "VM OS Disk Write Latency Alert Severity", + "description": "Severity of the alert for VM OS Disk Write Latency" + } + }, + "VMOSDiskWriteLatencyWindowSize": { + "type": "string", + "defaultValue": "PT15M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "VM OS Disk Write Latency Window Size", + "description": "Window size for the alert" + } + }, + "VMOSDiskWriteLatencyEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "VM OS Disk Write Latency Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VMOSDiskWriteLatencyAutoMitigate": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM OS Disk Write Latency Auto Mitigate", + "description": "Auto Mitigate for the alert" + } + }, + "VMOSDiskWriteLatencyAutoResolve": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM OS Disk Write Latency Auto Resolve", + "description": "Auto Resolve for the alert" + } + }, + "VMOSDiskWriteLatencyAutoResolveTime": { + "type": "string", + "defaultValue": "00:10:00", + "metadata": { + "displayName": "VM OS Disk Write Latency Auto Resolve Time", + "description": "Auto Resolve Time for the alert" + } + }, + "VMOSDiskWriteLatencyPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "VM OS Disk Write Latency Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "VMOSDiskWriteLatencyAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM OS Disk Write Latency Alert State", + "description": "Alert state for the alert, true will enable the alert, false will disable the alert" + } + }, + "VMOSDiskWriteLatencyThreshold": { + "type": "string", + "defaultValue": "30", + "metadata": { + "displayName": "VM OS Disk Write Latency Threshold", + "description": "Threshold for the alert" + } + }, + "VMOSDiskWriteLatencyOperator": { + "type": "string", + "defaultValue": "GreaterThan", + "allowedValues": [ + "GreaterThan" + ], + "metadata": { + "displayName": "VM OS Disk Write Latency Operator", + "description": "Operator for the alert" + } + }, + "VMOSDiskWriteLatencyTimeAggregation": { + "type": "string", + "defaultValue": "Count", + "allowedValues": [ + "Count" + ], + "metadata": { + "displayName": "VM OS Disk Write Latency Time Aggregation", + "description": "Time Aggregation for the alert" + } + }, + "VMOSDiskWriteLatencyEvaluationPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM OS Disk Write Latency Evaluation Periods", + "description": "Evaluation Periods for the alert" + } + }, + "VMOSDiskWriteLatencyFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM OS Disk Write Latency Failing Periods", + "description": "Failing Periods for the alert" + } + }, + "VMOSDiskWriteLatencyComputersToInclude": { + "type": "array", + "defaultValue": [ + "*" + ], + "metadata": { + "displayName": "VM OS Disk Write Latency Computers To Include", + "description": "Computers To Include for the alert" + } + }, + "VMOSDiskSpaceAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "VM OS Disk Space Alert Severity", + "description": "Severity of the alert for VM OS Disk Space" + } + }, + "VMOSDiskSpaceWindowSize": { + "type": "string", + "defaultValue": "PT15M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "VM OS Disk Space Window Size", + "description": "Window size for the alert" + } + }, + "VMOSDiskSpaceEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "VM OS Disk Space Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VMOSDiskSpaceAutoMitigate": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM OS Disk Space Auto Mitigate", + "description": "Auto Mitigate for the alert" + } + }, + "VMOSDiskSpaceAutoResolve": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM OS Disk Space Auto Resolve", + "description": "Auto Resolve for the alert" + } + }, + "VMOSDiskSpaceAutoResolveTime": { + "type": "string", + "defaultValue": "00:10:00", + "metadata": { + "displayName": "VM OS Disk Space Auto Resolve Time", + "description": "Auto Resolve Time for the alert" + } + }, + "VMOSDiskSpacePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "VM OS Disk Space Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "VMOSDiskSpaceAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM OS Disk Space Alert State", + "description": "Alert state for the alert, true will enable the alert, false will disable the alert" + } + }, + "VMOSDiskSpaceThreshold": { + "type": "string", + "defaultValue": "10", + "metadata": { + "displayName": "VM OS Disk Space Threshold", + "description": "Threshold for the alert" + } + }, + "VMOSDiskSpaceOperator": { + "type": "string", + "defaultValue": "GreaterThan", + "allowedValues": [ + "GreaterThan" + ], + "metadata": { + "displayName": "VM OS Disk Space Operator", + "description": "Operator for the alert" + } + }, + "VMOSDiskSpaceTimeAggregation": { + "type": "string", + "defaultValue": "Count", + "allowedValues": [ + "Count" + ], + "metadata": { + "displayName": "VM OS Disk Space Time Aggregation", + "description": "Time Aggregation for the alert" + } + }, + "VMOSDiskSpaceEvaluationPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM OS Disk Space Evaluation Periods", + "description": "Evaluation Periods for the alert" + } + }, + "VMOSDiskSpaceFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM OS Disk Space Failing Periods", + "description": "Failing Periods for the alert" + } + }, + "VMOSDiskSpaceComputersToInclude": { + "type": "array", + "defaultValue": [ + "*" + ], + "metadata": { + "displayName": "VM OS Disk Space Computers To Include", + "description": "Computers To Include for the alert" + } + }, + "VMPercentCPUAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "VM Percent CPU Alert Severity", + "description": "Severity of the alert for VM Percent CPU" + } + }, + "VMPercentCPUWindowSize": { + "type": "string", + "defaultValue": "PT15M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "VM Percent CPU Window Size", + "description": "Window size for the alert" + } + }, + "VMPercentCPUEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "VM Percent CPU Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VMPercentCPUAutoMitigate": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Percent CPU Auto Mitigate", + "description": "Auto Mitigate for the alert" + } + }, + "VMPercentCPUAutoResolve": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Percent CPU Auto Resolve", + "description": "Auto Resolve for the alert" + } + }, + "VMPercentCPUAutoResolveTime": { + "type": "string", + "defaultValue": "00:10:00", + "metadata": { + "displayName": "VM Percent CPU Auto Resolve Time", + "description": "Auto Resolve Time for the alert" + } + }, + "VMPercentCPUPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "VM Percent CPU Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "VMPercentCPUAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Percent CPU Alert State", + "description": "Alert state for the alert, true will enable the alert, false will disable the alert" + } + }, + "VMPercentCPUThreshold": { + "type": "string", + "defaultValue": "85", + "metadata": { + "displayName": "VM Percent CPU Threshold", + "description": "Threshold for the alert" + } + }, + "VMPercentCPUOperator": { + "type": "string", + "defaultValue": "GreaterThan", + "allowedValues": [ + "Equals", + "GreaterThan", + "GreaterThanOrEqual", + "LessThan", + "LessThanOrEqual" + ], + "metadata": { + "displayName": "VM Percent CPU Operator", + "description": "Operator for the alert" + } + }, + "VMPercentCPUTimeAggregation": { + "type": "string", + "defaultValue": "Count", + "allowedValues": [ + "Count" + ], + "metadata": { + "displayName": "VM Percent CPU Time Aggregation", + "description": "Time Aggregation for the alert" + } + }, + "VMPercentCPUFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM Percent CPU Failing Periods", + "description": "Failing Periods for the alert" + } + }, + "VMPercentMemoryAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "VM Percent Memory Alert Severity", + "description": "Severity of the alert for VM Percent Memory" + } + }, + "VMPercentMemoryWindowSize": { + "type": "string", + "defaultValue": "PT15M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "VM Percent Memory Window Size", + "description": "Window size for the alert" + } + }, + "VMPercentMemoryEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "VM Percent Memory Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VMPercentMemoryAutoMitigate": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Percent Memory Auto Mitigate", + "description": "Auto Mitigate for the alert" + } + }, + "VMPercentMemoryAutoResolve": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Percent Memory Auto Resolve", + "description": "Auto Resolve for the alert" + } + }, + "VMPercentMemoryAutoResolveTime": { + "type": "string", + "defaultValue": "00:10:00", + "metadata": { + "displayName": "VM Percent Memory Auto Resolve Time", + "description": "Auto Resolve Time for the alert" + } + }, + "VMPercentMemoryPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "VM Percent Memory Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "VMPercentMemoryAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Percent Memory Alert State", + "description": "Alert state for the alert, true will enable the alert, false will disable the alert" + } + }, + "VMPercentMemoryThreshold": { + "type": "string", + "defaultValue": "10", + "metadata": { + "displayName": "VM Percent Memory Threshold", + "description": "Threshold for the alert" + } + }, + "VMPercentMemoryOperator": { + "type": "string", + "defaultValue": "GreaterThan", + "allowedValues": [ + "GreaterThan" + ], + "metadata": { + "displayName": "VM Percent Memory Operator", + "description": "Operator for the alert" + } + }, + "VMPercentMemoryTimeAggregation": { + "type": "string", + "defaultValue": "Count", + "allowedValues": [ + "Count" + ], + "metadata": { + "displayName": "VM Percent Memory Time Aggregation", + "description": "Time Aggregation for the alert" + } + }, + "VMPercentMemoryFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM Percent Memory Failing Periods", + "description": "Failing Periods for the alert" + } + }, + "VMDataDiskSpaceAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "VM Data Disk Space Alert Severity", + "description": "Severity of the alert for VM Data Disk Space" + } + }, + "VMDataDiskSpaceWindowSize": { + "type": "string", + "defaultValue": "PT15M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "VM Data Disk Space Window Size", + "description": "Window size for the alert" + } + }, + "VMDataDiskSpaceEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "VM Data Disk Space Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VMDataDiskSpaceAutoMitigate": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Data Disk Space Auto Mitigate", + "description": "Auto Mitigate for the alert" + } + }, + "VMDataDiskSpaceAutoResolve": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Data Disk Space Auto Resolve", + "description": "Auto Resolve for the alert" + } + }, + "VMDataDiskSpaceAutoResolveTime": { + "type": "string", + "defaultValue": "00:10:00", + "metadata": { + "displayName": "VM Data Disk Space Auto Resolve Time", + "description": "Auto Resolve Time for the alert" + } + }, + "VMDataDiskSpacePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "VM Data Disk Space Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "VMDataDiskSpaceAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Data Disk Space Alert State", + "description": "Alert state for the alert, true will enable the alert, false will disable the alert" + } + }, + "VMDataDiskSpaceThreshold": { + "type": "string", + "defaultValue": "10", + "metadata": { + "displayName": "VM Data Disk Space Threshold", + "description": "Threshold for the alert" + } + }, + "VMDataDiskSpaceOperator": { + "type": "string", + "defaultValue": "GreaterThan", + "allowedValues": [ + "GreaterThan" + ], + "metadata": { + "displayName": "VM Data Disk Space Operator", + "description": "Operator for the alert" + } + }, + "VMDataDiskSpaceTimeAggregation": { + "type": "string", + "defaultValue": "Count", + "allowedValues": [ + "Count" + ], + "metadata": { + "displayName": "VM Data Disk Space Time Aggregation", + "description": "Time Aggregation for the alert" + } + }, + "VMDataDiskSpaceEvaluationPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM Data Disk Space Evaluation Periods", + "description": "Evaluation Periods for the alert" + } + }, + "VMDataDiskSpaceFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM Data Disk Space Failing Periods", + "description": "Failing Periods for the alert" + } + }, + "VMDataDiskSpaceComputersToInclude": { + "type": "array", + "defaultValue": [ + "*" + ], + "metadata": { + "displayName": "VM Data Disk Space Computers To Include", + "description": "Computers To Include for the alert" + } + }, + "VMDataDiskReadLatencyAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "VM Data Disk Read Latency Alert Severity", + "description": "Severity of the alert for VM Data Disk Read Latency" + } + }, + "VMDataDiskReadLatencyWindowSize": { + "type": "string", + "defaultValue": "PT15M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "VM Data Disk Read Latency Window Size", + "description": "Window size for the alert" + } + }, + "VMDataDiskReadLatencyEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "VM Data Disk Read Latency Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VMDataDiskReadLatencyAutoMitigate": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Data Disk Read Latency Auto Mitigate", + "description": "Auto Mitigate for the alert" + } + }, + "VMDataDiskReadLatencyAutoResolve": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Data Disk Read Latency Auto Resolve", + "description": "Auto Resolve for the alert" + } + }, + "VMDataDiskReadLatencyAutoResolveTime": { + "type": "string", + "defaultValue": "00:10:00", + "metadata": { + "displayName": "VM Data Disk Read Latency Auto Resolve Time", + "description": "Auto Resolve Time for the alert" + } + }, + "VMDataDiskReadLatencyPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "VM Data Disk Read Latency Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "VMDataDiskReadLatencyAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Data Disk Read Latency Alert State", + "description": "Alert state for the alert, true will enable the alert, false will disable the alert" + } + }, + "VMDataDiskReadLatencyThreshold": { + "type": "string", + "defaultValue": "30", + "metadata": { + "displayName": "VM Data Disk Read Latency Threshold", + "description": "Threshold for the alert" + } + }, + "VMDataDiskReadLatencyOperator": { + "type": "string", + "defaultValue": "GreaterThan", + "allowedValues": [ + "GreaterThan" + ], + "metadata": { + "displayName": "VM Data Disk Read Latency Operator", + "description": "Operator for the alert" + } + }, + "VMDataDiskReadLatencyTimeAggregation": { + "type": "string", + "defaultValue": "Count", + "allowedValues": [ + "Count" + ], + "metadata": { + "displayName": "VM Data Disk Read Latency Time Aggregation", + "description": "Time Aggregation for the alert" + } + }, + "VMDataDiskReadLatencyEvaluationPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM Data Disk Read Latency Evaluation Periods", + "description": "Evaluation Periods for the alert" + } + }, + "VMDataDiskReadLatencyFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM Data Disk Read Latency Failing Periods", + "description": "Failing Periods for the alert" + } + }, + "VMDataDiskReadLatencyComputersToInclude": { + "type": "array", + "defaultValue": [ + "*" + ], + "metadata": { + "displayName": "VM Data Disk Read Latency Computers To Include", + "description": "Computers To Include for the alert" + } + }, + "VMDataDiskWriteLatencyAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "VM Data Disk Write Latency Alert Severity", + "description": "Severity of the alert for VM Data Disk Write Latency" + } + }, + "VMDataDiskWriteLatencyWindowSize": { + "type": "string", + "defaultValue": "PT15M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "VM Data Disk Write Latency Window Size", + "description": "Window size for the alert" + } + }, + "VMDataDiskWriteLatencyEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "VM Data Disk Write Latency Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VMDataDiskWriteLatencyAutoMitigate": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Data Disk Write Latency Auto Mitigate", + "description": "Auto Mitigate for the alert" + } + }, + "VMDataDiskWriteLatencyAutoResolve": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Data Disk Write Latency Auto Resolve", + "description": "Auto Resolve for the alert" + } + }, + "VMDataDiskWriteLatencyAutoResolveTime": { + "type": "string", + "defaultValue": "00:10:00", + "metadata": { + "displayName": "VM Data Disk Write Latency Auto Resolve Time", + "description": "Auto Resolve Time for the alert" + } + }, + "VMDataDiskWriteLatencyPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "VM Data Disk Write Latency Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "VMDataDiskWriteLatencyAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Data Disk Write Latency Alert State", + "description": "Alert state for the alert, true will enable the alert, false will disable the alert" + } + }, + "VMDataDiskWriteLatencyThreshold": { + "type": "string", + "defaultValue": "30", + "metadata": { + "displayName": "VM Data Disk Write Latency Threshold", + "description": "Threshold for the alert" + } + }, + "VMDataDiskWriteLatencyOperator": { + "type": "string", + "defaultValue": "GreaterThan", + "allowedValues": [ + "GreaterThan" + ], + "metadata": { + "displayName": "VM Data Disk Write Latency Operator", + "description": "Operator for the alert" + } + }, + "VMDataDiskWriteLatencyTimeAggregation": { + "type": "string", + "defaultValue": "Count", + "allowedValues": [ + "Count" + ], + "metadata": { + "displayName": "VM Data Disk Write Latency Time Aggregation", + "description": "Time Aggregation for the alert" + } + }, + "VMDataDiskWriteLatencyEvaluationPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM Data Disk Write Latency Evaluation Periods", + "description": "Evaluation Periods for the alert" + } + }, + "VMDataDiskWriteLatencyFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM Data Disk Write Latency Failing Periods", + "description": "Failing Periods for the alert" + } + }, + "VMDataDiskWriteLatencyComputersToInclude": { + "type": "array", + "defaultValue": [ + "*" + ], + "metadata": { + "displayName": "VM Data Disk Write Latency Computers To Include", + "description": "Computers To Include for the alert" + } + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "ALZ_VMHeartBeatRG", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VM_HeartBeat_Alert", + "parameters": { + "UAMIResourceId": { + "value": "[[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), concat('/subscriptions/', parameters('ALZManagementSubscriptionId'), '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('ALZUserAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "severity": { + "value": "[[[parameters('VMHeartBeatRGAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('VMHeartBeatRGWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('VMHeartBeatRGEvaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[[parameters('VMHeartBeatRGAutoMitigate')]" + }, + "autoResolve": { + "value": "[[[parameters('VMHeartBeatRGAutoResolve')]" + }, + "autoResolveTime": { + "value": "[[[parameters('VMHeartBeatRGAutoResolveTime')]" + }, + "effect": { + "value": "[[[parameters('VMHeartBeatRGPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('VMHeartBeatRGAlertState')]" + }, + "threshold": { + "value": "[[[parameters('VMHeartBeatRGThreshold')]" + }, + "operator": { + "value": "[[[parameters('VMHeartBeatRGOperator')]" + }, + "timeAggregation": { + "value": "[[[parameters('VMHeartBeatRGTimeAggregation')]" + }, + "computersToInclude": { + "value": "[[[parameters('VMHeartBeatRGComputersToInclude')]" + }, + "failingPeriods": { + "value": "[[[parameters('VMHeartBeatRGFailingPeriods')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VMNetworkIn", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VM_NetworkIn_Alert", + "parameters": { + "UAMIResourceId": { + "value": "[[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), concat('/subscriptions/', parameters('ALZManagementSubscriptionId'), '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('ALZUserAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" + }, + "severity": { + "value": "[[[parameters('VMNetworkInAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('VMNetworkInWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('VMNetworkInEvaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[[parameters('VMNetworkInAutoMitigate')]" + }, + "autoResolve": { + "value": "[[[parameters('VMNetworkInAutoResolve')]" + }, + "autoResolveTime": { + "value": "[[[parameters('VMNetworkInAutoResolveTime')]" + }, + "effect": { + "value": "[[[parameters('VMNetworkInPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('VMNetworkInAlertState')]" + }, + "threshold": { + "value": "[[[parameters('VMNetworkInThreshold')]" + }, + "operator": { + "value": "[[[parameters('VMNetworkInOperator')]" + }, + "timeAggregation": { + "value": "[[[parameters('VMNetworkInTimeAggregation')]" + }, + "failingPeriods": { + "value": "[[[parameters('VMNetworkInFailingPeriods')]" + }, + "evaluationPeriods": { + "value": "[[[parameters('VMNetworkInEvaluationPeriods')]" + }, + "computersToInclude": { + "value": "[[[parameters('VMNetworkInComputersToInclude')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VMNetworkOut", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VM_NetworkOut_Alert", + "parameters": { + "UAMIResourceId": { + "value": "[[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), concat('/subscriptions/', parameters('ALZManagementSubscriptionId'), '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('ALZUserAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" + }, + "severity": { + "value": "[[[parameters('VMNetworkOutAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('VMNetworkOutWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('VMNetworkOutEvaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[[parameters('VMNetworkOutAutoMitigate')]" + }, + "autoResolve": { + "value": "[[[parameters('VMNetworkOutAutoResolve')]" + }, + "autoResolveTime": { + "value": "[[[parameters('VMNetworkOutAutoResolveTime')]" + }, + "effect": { + "value": "[[[parameters('VMNetworkOutPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('VMNetworkOutAlertState')]" + }, + "threshold": { + "value": "[[[parameters('VMNetworkOutThreshold')]" + }, + "operator": { + "value": "[[[parameters('VMNetworkOutOperator')]" + }, + "timeAggregation": { + "value": "[[[parameters('VMNetworkOutTimeAggregation')]" + }, + "failingPeriods": { + "value": "[[[parameters('VMNetworkOutFailingPeriods')]" + }, + "evaluationPeriods": { + "value": "[[[parameters('VMNetworkOutEvaluationPeriods')]" + }, + "computersToInclude": { + "value": "[[[parameters('VMNetworkOutComputersToInclude')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VMOSDiskReadLatency", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VM_OSDiskreadLatency_Alert", + "parameters": { + "UAMIResourceId": { + "value": "[[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), concat('/subscriptions/', parameters('ALZManagementSubscriptionId'), '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('ALZUserAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" + }, + "severity": { + "value": "[[[parameters('VMOSDiskReadLatencyAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('VMOSDiskReadLatencyWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('VMOSDiskReadLatencyEvaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[[parameters('VMOSDiskReadLatencyAutoMitigate')]" + }, + "autoResolve": { + "value": "[[[parameters('VMOSDiskReadLatencyAutoResolve')]" + }, + "autoResolveTime": { + "value": "[[[parameters('VMOSDiskReadLatencyAutoResolveTime')]" + }, + "effect": { + "value": "[[[parameters('VMOSDiskReadLatencyPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('VMOSDiskReadLatencyAlertState')]" + }, + "threshold": { + "value": "[[[parameters('VMOSDiskReadLatencyThreshold')]" + }, + "operator": { + "value": "[[[parameters('VMOSDiskReadLatencyOperator')]" + }, + "timeAggregation": { + "value": "[[[parameters('VMOSDiskReadLatencyTimeAggregation')]" + }, + "failingPeriods": { + "value": "[[[parameters('VMOSDiskReadLatencyFailingPeriods')]" + }, + "evaluationPeriods": { + "value": "[[[parameters('VMOSDiskReadLatencyEvaluationPeriods')]" + }, + "computersToInclude": { + "value": "[[[parameters('VMOSDiskReadLatencyComputersToInclude')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VMOSDiskWriteLatency", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VM_OSDiskwriteLatency_Alert", + "parameters": { + "UAMIResourceId": { + "value": "[[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), concat('/subscriptions/', parameters('ALZManagementSubscriptionId'), '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('ALZUserAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" + }, + "severity": { + "value": "[[[parameters('VMOSDiskWriteLatencyAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('VMOSDiskWriteLatencyWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('VMOSDiskWriteLatencyEvaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[[parameters('VMOSDiskWriteLatencyAutoMitigate')]" + }, + "autoResolve": { + "value": "[[[parameters('VMOSDiskWriteLatencyAutoResolve')]" + }, + "autoResolveTime": { + "value": "[[[parameters('VMOSDiskWriteLatencyAutoResolveTime')]" + }, + "effect": { + "value": "[[[parameters('VMOSDiskWriteLatencyPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('VMOSDiskWriteLatencyAlertState')]" + }, + "threshold": { + "value": "[[[parameters('VMOSDiskWriteLatencyThreshold')]" + }, + "operator": { + "value": "[[[parameters('VMOSDiskWriteLatencyOperator')]" + }, + "timeAggregation": { + "value": "[[[parameters('VMOSDiskWriteLatencyTimeAggregation')]" + }, + "failingPeriods": { + "value": "[[[parameters('VMOSDiskWriteLatencyFailingPeriods')]" + }, + "evaluationPeriods": { + "value": "[[[parameters('VMOSDiskWriteLatencyEvaluationPeriods')]" + }, + "computersToInclude": { + "value": "[[[parameters('VMOSDiskWriteLatencyComputersToInclude')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VMOSDiskSpace", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VM_OSDiskSpace_Alert", + "parameters": { + "UAMIResourceId": { + "value": "[[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), concat('/subscriptions/', parameters('ALZManagementSubscriptionId'), '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('ALZUserAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" + }, + "severity": { + "value": "[[[parameters('VMOSDiskSpaceAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('VMOSDiskSpaceWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('VMOSDiskSpaceEvaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[[parameters('VMOSDiskSpaceAutoMitigate')]" + }, + "autoResolve": { + "value": "[[[parameters('VMOSDiskSpaceAutoResolve')]" + }, + "autoResolveTime": { + "value": "[[[parameters('VMOSDiskSpaceAutoResolveTime')]" + }, + "effect": { + "value": "[[[parameters('VMOSDiskSpacePolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('VMOSDiskSpaceAlertState')]" + }, + "threshold": { + "value": "[[[parameters('VMOSDiskSpaceThreshold')]" + }, + "operator": { + "value": "[[[parameters('VMOSDiskSpaceOperator')]" + }, + "timeAggregation": { + "value": "[[[parameters('VMOSDiskSpaceTimeAggregation')]" + }, + "failingPeriods": { + "value": "[[[parameters('VMOSDiskSpaceFailingPeriods')]" + }, + "evaluationPeriods": { + "value": "[[[parameters('VMOSDiskSpaceEvaluationPeriods')]" + }, + "computersToInclude": { + "value": "[[[parameters('VMOSDiskSpaceComputersToInclude')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VMPercentCPU", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VM_CPU_Alert", + "parameters": { + "UAMIResourceId": { + "value": "[[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), concat('/subscriptions/', parameters('ALZManagementSubscriptionId'), '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('ALZUserAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" + }, + "severity": { + "value": "[[[parameters('VMPercentCPUAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('VMPercentCPUWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('VMPercentCPUEvaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[[parameters('VMPercentCPUAutoMitigate')]" + }, + "autoResolve": { + "value": "[[[parameters('VMPercentCPUAutoResolve')]" + }, + "autoResolveTime": { + "value": "[[[parameters('VMPercentCPUAutoResolveTime')]" + }, + "effect": { + "value": "[[[parameters('VMPercentCPUPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('VMPercentCPUAlertState')]" + }, + "threshold": { + "value": "[[[parameters('VMPercentCPUThreshold')]" + }, + "operator": { + "value": "[[[parameters('VMPercentCPUOperator')]" + }, + "timeAggregation": { + "value": "[[[parameters('VMPercentCPUTimeAggregation')]" + }, + "failingPeriods": { + "value": "[[[parameters('VMPercentCPUFailingPeriods')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VMPercentMemory", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VM_Memory_Alert", + "parameters": { + "UAMIResourceId": { + "value": "[[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), concat('/subscriptions/', parameters('ALZManagementSubscriptionId'), '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('ALZUserAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" + }, + "severity": { + "value": "[[[parameters('VMPercentMemoryAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('VMPercentMemoryWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('VMPercentMemoryEvaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[[parameters('VMPercentMemoryAutoMitigate')]" + }, + "autoResolve": { + "value": "[[[parameters('VMPercentMemoryAutoResolve')]" + }, + "autoResolveTime": { + "value": "[[[parameters('VMPercentMemoryAutoResolveTime')]" + }, + "effect": { + "value": "[[[parameters('VMPercentMemoryPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('VMPercentMemoryAlertState')]" + }, + "threshold": { + "value": "[[[parameters('VMPercentMemoryThreshold')]" + }, + "operator": { + "value": "[[[parameters('VMPercentMemoryOperator')]" + }, + "timeAggregation": { + "value": "[[[parameters('VMPercentMemoryTimeAggregation')]" + }, + "failingPeriods": { + "value": "[[[parameters('VMPercentMemoryFailingPeriods')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VMDataDiskSpace", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VM_dataDiskSpace_Alert", + "parameters": { + "UAMIResourceId": { + "value": "[[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), concat('/subscriptions/', parameters('ALZManagementSubscriptionId'), '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('ALZUserAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" + }, + "severity": { + "value": "[[[parameters('VMDataDiskSpaceAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('VMDataDiskSpaceWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('VMDataDiskSpaceEvaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[[parameters('VMDataDiskSpaceAutoMitigate')]" + }, + "autoResolve": { + "value": "[[[parameters('VMDataDiskSpaceAutoResolve')]" + }, + "autoResolveTime": { + "value": "[[[parameters('VMDataDiskSpaceAutoResolveTime')]" + }, + "effect": { + "value": "[[[parameters('VMDataDiskSpacePolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('VMDataDiskSpaceAlertState')]" + }, + "threshold": { + "value": "[[[parameters('VMDataDiskSpaceThreshold')]" + }, + "operator": { + "value": "[[[parameters('VMDataDiskSpaceOperator')]" + }, + "timeAggregation": { + "value": "[[[parameters('VMDataDiskSpaceTimeAggregation')]" + }, + "failingPeriods": { + "value": "[[[parameters('VMDataDiskSpaceFailingPeriods')]" + }, + "evaluationPeriods": { + "value": "[[[parameters('VMDataDiskSpaceEvaluationPeriods')]" + }, + "computersToInclude": { + "value": "[[[parameters('VMDataDiskSpaceComputersToInclude')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VMDataDiskReadLatency", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VM_dataDiskReadLatency_Alert", + "parameters": { + "UAMIResourceId": { + "value": "[[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), concat('/subscriptions/', parameters('ALZManagementSubscriptionId'), '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('ALZUserAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" + }, + "severity": { + "value": "[[[parameters('VMDataDiskReadLatencyAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('VMDataDiskReadLatencyWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('VMDataDiskReadLatencyEvaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[[parameters('VMDataDiskReadLatencyAutoMitigate')]" + }, + "autoResolve": { + "value": "[[[parameters('VMDataDiskReadLatencyAutoResolve')]" + }, + "autoResolveTime": { + "value": "[[[parameters('VMDataDiskReadLatencyAutoResolveTime')]" + }, + "effect": { + "value": "[[[parameters('VMDataDiskReadLatencyPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('VMDataDiskReadLatencyAlertState')]" + }, + "threshold": { + "value": "[[[parameters('VMDataDiskReadLatencyThreshold')]" + }, + "operator": { + "value": "[[[parameters('VMDataDiskReadLatencyOperator')]" + }, + "timeAggregation": { + "value": "[[[parameters('VMDataDiskReadLatencyTimeAggregation')]" + }, + "failingPeriods": { + "value": "[[[parameters('VMDataDiskReadLatencyFailingPeriods')]" + }, + "evaluationPeriods": { + "value": "[[[parameters('VMDataDiskReadLatencyEvaluationPeriods')]" + }, + "computersToInclude": { + "value": "[[[parameters('VMDataDiskReadLatencyComputersToInclude')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VMDataDiskWriteLatency", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VM_dataDiskWriteLatency_Alert", + "parameters": { + "UAMIResourceId": { + "value": "[[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), concat('/subscriptions/', parameters('ALZManagementSubscriptionId'), '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('ALZUserAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" + }, + "severity": { + "value": "[[[parameters('VMDataDiskWriteLatencyAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('VMDataDiskWriteLatencyWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('VMDataDiskWriteLatencyEvaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[[parameters('VMDataDiskWriteLatencyAutoMitigate')]" + }, + "autoResolve": { + "value": "[[[parameters('VMDataDiskWriteLatencyAutoResolve')]" + }, + "autoResolveTime": { + "value": "[[[parameters('VMDataDiskWriteLatencyAutoResolveTime')]" + }, + "effect": { + "value": "[[[parameters('VMDataDiskWriteLatencyPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('VMDataDiskWriteLatencyAlertState')]" + }, + "threshold": { + "value": "[[[parameters('VMDataDiskWriteLatencyThreshold')]" + }, + "operator": { + "value": "[[[parameters('VMDataDiskWriteLatencyOperator')]" + }, + "timeAggregation": { + "value": "[[[parameters('VMDataDiskWriteLatencyTimeAggregation')]" + }, + "failingPeriods": { + "value": "[[[parameters('VMDataDiskWriteLatencyFailingPeriods')]" + }, + "evaluationPeriods": { + "value": "[[[parameters('VMDataDiskWriteLatencyEvaluationPeriods')]" + }, + "computersToInclude": { + "value": "[[[parameters('VMDataDiskWriteLatencyComputersToInclude')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + } + ], + "policyType": "Custom", + "policyDefinitionGroups": null + } + }, + "$fxv#2": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VM_dataDiskWriteLatency_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VM Data Disk Write Latency Alert\",\n \"description\": \"Policy to audit/deploy VM dataDiskWriteLatency Alert\",\n \"metadata\": {\n \"version\": \"1.4.0\",\n \"category\": \"Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"30\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Compute/virtualMachines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-VMHighDataDiskWriteLatencyAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteLatencyMs-Data-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteLatencyMs-Data-threshold-override_\\\", tostring(tags.[\\\"_amba-WriteLatencyMs-Data-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"VMdataDiskWriteLatencyAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-VMHighDataDiskWriteLatencyAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-VMHighDataDiskWriteLatencyAlert')]\",\n \"description\": \"Log Alert for Virtual Machine dataDiskWriteLatency\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.Compute/virtualMachines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteLatencyMs-Data-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteLatencyMs-Data-threshold-override_\\\", tostring(tags.[\\\"_amba-WriteLatencyMs-Data-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"Disk\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#3": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VM_HeartBeat_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VM HeartBeat Alert\",\n \"description\": \"Policy to audit/deploy VM HeartBeat Alert for all VMs in the subscription\",\n \"metadata\": {\n \"version\": \"1.4.0\",\n \"category\": \"Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"1\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT6H\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"10\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Compute/virtualMachines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-VMHeartBeatAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-Heartbeat-threshold-override_\\\"); Heartbeat | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | summarize TimeGenerated=max(TimeGenerated) by Computer, _ResourceId | extend Duration = datetime_diff(\\\"minute\\\",now(),TimeGenerated) | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-Heartbeat-threshold-override_\\\", tostring(tags.[\\\"_amba-Heartbeat-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where Duration > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Duration', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HeartBeatAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-VMHeartBeatAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-VMHeartBeatAlert')]\",\n \"description\": \"Log Alert for Virtual Machine Heartbeat\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.Compute/virtualMachines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-Heartbeat-threshold-override_\\\"); Heartbeat | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | summarize TimeGenerated=max(TimeGenerated) by Computer, _ResourceId | extend Duration = datetime_diff(\\\"minute\\\",now(),TimeGenerated) | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-Heartbeat-threshold-override_\\\", tostring(tags.[\\\"_amba-Heartbeat-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where Duration > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Duration', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#4": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VM_NetworkIn_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VM Network Read Alert\",\n \"description\": \"Policy to audit/deploy VM Network Read Alert\",\n \"metadata\": {\n \"version\": \"1.4.0\",\n \"category\": \"Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"10000000\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Compute/virtualMachines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-VMHighNetworkInAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadBytesPerSecond-Data-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Network\\\" and Name == \\\"ReadBytesPerSecond\\\" | extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadBytesPerSecond-Data-threshold-override_\\\", tostring(tags.[\\\"_amba-ReadBytesPerSecond-Data-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"VMNetworkInAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-VMHighNetworkInAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-VMHighNetworkInAlert')]\",\n \"description\": \"Log Alert for Virtual Machine NetworkIn\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.Compute/virtualMachines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadBytesPerSecond-Data-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Network\\\" and Name == \\\"ReadBytesPerSecond\\\" | extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadBytesPerSecond-Data-threshold-override_\\\", tostring(tags.[\\\"_amba-ReadBytesPerSecond-Data-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"NetworkInterface\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#5": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VM_NetworkOut_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VM Network Write Alert\",\n \"description\": \"Policy to audit/deploy VM Network Out Alert\",\n \"metadata\": {\n \"version\": \"1.4.0\",\n \"category\": \"Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"10000000\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Compute/virtualMachines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-VMHighNetworkOutAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteBytesPerSecond-Data-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Network\\\" and Name == \\\"WriteBytesPerSecond\\\" | extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteBytesPerSecond-Data-threshold-override_\\\", tostring(tags.[\\\"_amba-WriteBytesPerSecond-Data-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"VMNetworkOutAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-VMHighNetworkOutAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-VMHighNetworkOutAlert')]\",\n \"description\": \"Log Alert for Virtual Machine NetworkOut\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.Compute/virtualMachines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteBytesPerSecond-Data-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Network\\\" and Name == \\\"WriteBytesPerSecond\\\" | extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteBytesPerSecond-Data-threshold-override_\\\", tostring(tags.[\\\"_amba-WriteBytesPerSecond-Data-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"NetworkInterface\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#6": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VM_OSDiskreadLatency_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VM OS Disk Read Latency Alert\",\n \"description\": \"Policy to audit/deploy VM OSDiskreadLatency Alert\",\n \"metadata\": {\n \"version\": \"1.4.0\",\n \"category\": \"Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"30\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Compute/virtualMachines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-VMHighOSDiskReadLatencyAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadLatencyMs-OS-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadLatencyMs-OS-threshold-override_\\\", tostring(tags.[\\\"_amba-ReadLatencyMs-OS-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"VMOSDiskreadLatencyAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-VMHighOSDiskReadLatencyAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-VMHighOSDiskReadLatencyAlert')]\",\n \"description\": \"Log Alert for Virtual Machine OSDiskreadLatency\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.Compute/virtualMachines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadLatencyMs-OS-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadLatencyMs-OS-threshold-override_\\\", tostring(tags.[\\\"_amba-ReadLatencyMs-OS-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"Disk\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#7": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VM_OSDiskSpace_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VM OS Disk Space Alert\",\n \"description\": \"Policy to audit/deploy VM OSDiskSpace Alert\",\n \"metadata\": {\n \"version\": \"1.4.0\",\n \"category\": \"Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"10\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Compute/virtualMachines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-VMLowOSDiskSpaceAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-FreeSpacePercentage-OS-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-FreeSpacePercentage-OS-threshold-override_\\\", tostring(tags.[\\\"_amba-FreeSpacePercentage-OS-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"VMOSDiskSpaceAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-VMLowOSDiskSpaceAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-VMLowOSDiskSpaceAlert')]\",\n \"description\": \"Log Alert for Virtual Machine OSDiskSpace\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.Compute/virtualMachines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-FreeSpacePercentage-OS-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-FreeSpacePercentage-OS-threshold-override_\\\", tostring(tags.[\\\"_amba-FreeSpacePercentage-OS-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"Disk\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#8": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VM_OSDiskwriteLatency_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VM OS Disk Write Latency Alert\",\n \"description\": \"Policy to audit/deploy VM OSDiskwriteLatency Alert\",\n \"metadata\": {\n \"version\": \"1.4.0\",\n \"category\": \"Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"30\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Compute/virtualMachines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-VMHighOSDiskWriteLatencyAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteLatencyMs-OS-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteLatencyMs-OS-threshold-override_\\\", tostring(tags.[\\\"_amba-WriteLatencyMs-OS-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"VMOSDiskwriteLatencyAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-VMHighOSDiskWriteLatencyAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-VMHighOSDiskWriteLatencyAlert')]\",\n \"description\": \"Log Alert for Virtual Machine OSDiskwriteLatency\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.Compute/virtualMachines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteLatencyMs-OS-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteLatencyMs-OS-threshold-override_\\\", tostring(tags.[\\\"_amba-WriteLatencyMs-OS-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"Disk\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#9": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VM_CPU_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VM CPU Alert\",\n \"description\": \"Policy to audit/deploy VM CPU Alert\",\n \"metadata\": {\n \"version\": \"1.4.0\",\n \"category\": \"Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"85\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Compute/virtualMachines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-VMHighCPUAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-UtilizationPercentage-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Processor\\\" and Name == \\\"UtilizationPercentage\\\" | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-UtilizationPercentage-threshold-override_\\\", tostring(tags.[\\\"_amba-UtilizationPercentage-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"VMCPUAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-VMHighCPUAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-VMHighCPUAlert')]\",\n \"description\": \"Log Alert for Virtual Machine CPU\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.Compute/virtualMachines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let excludedVMSSNodes = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.Compute/virtualMachines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-UtilizationPercentage-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.Compute/virtualMachines\\\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Processor\\\" and Name == \\\"UtilizationPercentage\\\" | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-UtilizationPercentage-threshold-override_\\\", tostring(tags.[\\\"_amba-UtilizationPercentage-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "cloudEnv": "[environment().name]", + "defaultDeploymentLocationByCloudType": { + "AzureCloud": "northeurope", + "AzureChinaCloud": "chinaeast2", + "AzureUSGovernment": "usgovvirginia" + }, + "templateVars": { + "scope": "/providers/Microsoft.Management/managementGroups/contoso", + "defaultDeploymentLocation": "\"location\": \"northeurope\"", + "localizedDeploymentLocation": "[format('\"location\": \"{0}\"', variables('defaultDeploymentLocationByCloudType')[variables('cloudEnv')])]" + }, + "targetDeploymentLocationByCloudType": { + "AzureCloud": "[coalesce(parameters('location'), 'northeurope')]", + "AzureChinaCloud": "[coalesce(parameters('location'), 'chinaeast2')]", + "AzureUSGovernment": "[coalesce(parameters('location'), 'usgovvirginia')]" + }, + "deploymentLocation": "[format('\"location\": \"{0}\"', variables('targetDeploymentLocationByCloudType')[variables('cloudEnv')])]", + "loadPolicyDefinitions": { + "All": [ + "[variables('$fxv#0')]", + "[variables('$fxv#1')]", + "[variables('$fxv#2')]", + "[variables('$fxv#3')]", + "[variables('$fxv#4')]", + "[variables('$fxv#5')]", + "[variables('$fxv#6')]", + "[variables('$fxv#7')]", + "[variables('$fxv#8')]", + "[variables('$fxv#9')]", + "[variables('$fxv#10')]" + ], + "AzureCloud": [], + "AzureChinaCloud": [], + "AzureUSGovernment": [] + }, + "loadPolicySetDefinitions": { + "All": [ + "[string(variables('$fxv#11'))]" + ], + "AzureCloud": [], + "AzureChinaCloud": [], + "AzureUSGovernment": [] + }, + "policyDefinitionsByCloudType": { + "All": "[variables('policyDefinitionsAll')]", + "AzureCloud": "[variables('policyDefinitionsAzureCloud')]", + "AzureChinaCloud": "[variables('policyDefinitionsAzureChinaCloud')]", + "AzureUSGovernment": "[variables('policyDefinitionsAzureUSGovernment')]" + }, + "policySetDefinitionsByCloudType": { + "All": "[variables('policySetDefinitionsAll')]", + "AzureCloud": "[variables('policySetDefinitionsAzureCloud')]", + "AzureChinaCloud": "[variables('policySetDefinitionsAzureChinaCloud')]", + "AzureUSGovernment": "[variables('policySetDefinitionsAzureUSGovernment')]" + }, + "policyDefinitions": "[concat(variables('policyDefinitionsByCloudType').All, variables('policyDefinitionsByCloudType')[variables('cloudEnv')])]", + "policySetDefinitions": "[concat(variables('policySetDefinitionsByCloudType').All, variables('policySetDefinitionsByCloudType')[variables('cloudEnv')])]" + }, + "resources": [ + { + "copy": { + "name": "PolicyDefinitions", + "count": "[length(variables('policyDefinitions'))]" + }, + "type": "Microsoft.Authorization/policyDefinitions", + "apiVersion": "2020-09-01", + "name": "[variables('policyDefinitions')[copyIndex()].name]", + "properties": { + "description": "[variables('policyDefinitions')[copyIndex()].properties.description]", + "displayName": "[variables('policyDefinitions')[copyIndex()].properties.displayName]", + "metadata": "[variables('policyDefinitions')[copyIndex()].properties.metadata]", + "mode": "[variables('policyDefinitions')[copyIndex()].properties.mode]", + "parameters": "[variables('policyDefinitions')[copyIndex()].properties.parameters]", + "policyType": "[variables('policyDefinitions')[copyIndex()].properties.policyType]", + "policyRule": "[variables('policyDefinitions')[copyIndex()].properties.policyRule]" + } + }, + { + "copy": { + "name": "PolicySetDefinitions", + "count": "[length(variables('policySetDefinitions'))]" + }, + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2020-09-01", + "name": "[variables('policySetDefinitions')[copyIndex()].name]", + "properties": { + "description": "[variables('policySetDefinitions')[copyIndex()].properties.description]", + "displayName": "[variables('policySetDefinitions')[copyIndex()].properties.displayName]", + "metadata": "[variables('policySetDefinitions')[copyIndex()].properties.metadata]", + "parameters": "[variables('policySetDefinitions')[copyIndex()].properties.parameters]", + "policyType": "[variables('policySetDefinitions')[copyIndex()].properties.policyType]", + "policyDefinitions": "[variables('policySetDefinitions')[copyIndex()].properties.policyDefinitions]", + "policyDefinitionGroups": "[variables('policySetDefinitions')[copyIndex()].properties.policyDefinitionGroups]" + }, + "dependsOn": [ + "PolicyDefinitions" + ] + } + ], + "outputs": { + "policyDefinitionNames": { + "type": "array", + "copy": { + "count": "[length(variables('policyDefinitions'))]", + "input": "[variables('policyDefinitions')[copyIndex()].name]" + } + }, + "policySetDefinitionNames": { + "type": "array", + "copy": { + "count": "[length(variables('policySetDefinitions'))]", + "input": "[variables('policySetDefinitions')[copyIndex()].name]" + } + } + } +} \ No newline at end of file diff --git a/patterns/alz/policyDefinitions/policies-Hybrid.json b/patterns/alz/policyDefinitions/policies-Hybrid.json new file mode 100644 index 000000000..9b9d77e1e --- /dev/null +++ b/patterns/alz/policyDefinitions/policies-Hybrid.json @@ -0,0 +1,2827 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-08-01/managementGroupDeploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.29.47.4906", + "templateHash": "7492840284618312842" + } + }, + "parameters": { + "topLevelManagementGroupPrefix": { + "type": "string", + "defaultValue": "alz", + "metadata": { + "message": "The JSON version of this file is programatically generated from Bicep. PLEASE DO NOT UPDATE MANUALLY!!", + "description": "Provide a prefix (unique at tenant-scope) for the Management Group hierarchy and other resources created as part of an Azure landing zone. DEFAULT VALUE = \"alz\"" + } + }, + "location": { + "type": "string", + "defaultValue": "[deployment().location]", + "metadata": { + "description": "Optionally set the deployment location for policies with Deploy If Not Exists effect. DEFAULT VALUE = \"deployment().location\"" + } + }, + "scope": { + "type": "string", + "defaultValue": "[tenantResourceId('Microsoft.Management/managementGroups', parameters('topLevelManagementGroupPrefix'))]", + "metadata": { + "description": "Optionally set the scope for custom Policy Definitions used in Policy Set Definitions (Initiatives). Must be one of '/', '/subscriptions/id' or '/providers/Microsoft.Management/managementGroups/id'. DEFAULT VALUE = '/providers/Microsoft.Management/managementGroups/${topLevelManagementGroupPrefix}'" + } + } + }, + "variables": { + "copy": [ + { + "name": "processPolicyDefinitionsAll", + "count": "[length(variables('loadPolicyDefinitions').All)]", + "input": "[replace(replace(variables('loadPolicyDefinitions').All[copyIndex('processPolicyDefinitionsAll')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" + }, + { + "name": "processPolicyDefinitionsAzureCloud", + "count": "[length(variables('loadPolicyDefinitions').AzureCloud)]", + "input": "[replace(replace(variables('loadPolicyDefinitions').AzureCloud[copyIndex('processPolicyDefinitionsAzureCloud')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" + }, + { + "name": "processPolicyDefinitionsAzureChinaCloud", + "count": "[length(variables('loadPolicyDefinitions').AzureChinaCloud)]", + "input": "[replace(replace(variables('loadPolicyDefinitions').AzureChinaCloud[copyIndex('processPolicyDefinitionsAzureChinaCloud')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" + }, + { + "name": "processPolicyDefinitionsAzureUSGovernment", + "count": "[length(variables('loadPolicyDefinitions').AzureUSGovernment)]", + "input": "[replace(replace(variables('loadPolicyDefinitions').AzureUSGovernment[copyIndex('processPolicyDefinitionsAzureUSGovernment')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" + }, + { + "name": "processPolicySetDefinitionsAll", + "count": "[length(variables('loadPolicySetDefinitions').All)]", + "input": "[replace(variables('loadPolicySetDefinitions').All[copyIndex('processPolicySetDefinitionsAll')], variables('templateVars').scope, parameters('scope'))]" + }, + { + "name": "processPolicySetDefinitionsAzureCloud", + "count": "[length(variables('loadPolicySetDefinitions').AzureCloud)]", + "input": "[replace(variables('loadPolicySetDefinitions').AzureCloud[copyIndex('processPolicySetDefinitionsAzureCloud')], variables('templateVars').scope, parameters('scope'))]" + }, + { + "name": "processPolicySetDefinitionsAzureChinaCloud", + "count": "[length(variables('loadPolicySetDefinitions').AzureChinaCloud)]", + "input": "[replace(variables('loadPolicySetDefinitions').AzureChinaCloud[copyIndex('processPolicySetDefinitionsAzureChinaCloud')], variables('templateVars').scope, parameters('scope'))]" + }, + { + "name": "processPolicySetDefinitionsAzureUSGovernment", + "count": "[length(variables('loadPolicySetDefinitions').AzureUSGovernment)]", + "input": "[replace(variables('loadPolicySetDefinitions').AzureUSGovernment[copyIndex('processPolicySetDefinitionsAzureUSGovernment')], variables('templateVars').scope, parameters('scope'))]" + }, + { + "name": "policyDefinitionsAll", + "count": "[length(variables('processPolicyDefinitionsAll'))]", + "input": "[json(variables('processPolicyDefinitionsAll')[copyIndex('policyDefinitionsAll')])]" + }, + { + "name": "policyDefinitionsAzureCloud", + "count": "[length(variables('processPolicyDefinitionsAzureCloud'))]", + "input": "[json(variables('processPolicyDefinitionsAzureCloud')[copyIndex('policyDefinitionsAzureCloud')])]" + }, + { + "name": "policyDefinitionsAzureChinaCloud", + "count": "[length(variables('processPolicyDefinitionsAzureChinaCloud'))]", + "input": "[json(variables('processPolicyDefinitionsAzureChinaCloud')[copyIndex('policyDefinitionsAzureChinaCloud')])]" + }, + { + "name": "policyDefinitionsAzureUSGovernment", + "count": "[length(variables('processPolicyDefinitionsAzureUSGovernment'))]", + "input": "[json(variables('processPolicyDefinitionsAzureUSGovernment')[copyIndex('policyDefinitionsAzureUSGovernment')])]" + }, + { + "name": "policySetDefinitionsAll", + "count": "[length(variables('processPolicySetDefinitionsAll'))]", + "input": "[json(variables('processPolicySetDefinitionsAll')[copyIndex('policySetDefinitionsAll')])]" + }, + { + "name": "policySetDefinitionsAzureCloud", + "count": "[length(variables('processPolicySetDefinitionsAzureCloud'))]", + "input": "[json(variables('processPolicySetDefinitionsAzureCloud')[copyIndex('policySetDefinitionsAzureCloud')])]" + }, + { + "name": "policySetDefinitionsAzureChinaCloud", + "count": "[length(variables('processPolicySetDefinitionsAzureChinaCloud'))]", + "input": "[json(variables('processPolicySetDefinitionsAzureChinaCloud')[copyIndex('policySetDefinitionsAzureChinaCloud')])]" + }, + { + "name": "policySetDefinitionsAzureUSGovernment", + "count": "[length(variables('processPolicySetDefinitionsAzureUSGovernment'))]", + "input": "[json(variables('processPolicySetDefinitionsAzureUSGovernment')[copyIndex('policySetDefinitionsAzureUSGovernment')])]" + } + ], + "$fxv#0": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Hybrid_VM_dataDiskReadLatency_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Hybrid VM Data Disk Read Latency Alert\",\n \"description\": \"Policy to audit/deploy VM dataDiskReadLatency Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Hybrid Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"30\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.HybridCompute/machines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighDataDiskReadLatencyAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadLatencyMs-Data-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\", \\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadLatencyMs-Data-threshold-override_\\\", tostring(tags.[\\\"_amba-ReadLatencyMs-Data-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HybridVMdataDiskReadLatencyAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighDataDiskReadLatencyAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighDataDiskReadLatencyAlert')]\",\n \"description\": \"Log Alert for Virtual Machine dataDiskReadLatency\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.HybridCompute/machines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadLatencyMs-Data-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\", \\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadLatencyMs-Data-threshold-override_\\\", tostring(tags.[\\\"_amba-ReadLatencyMs-Data-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"Disk\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#1": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Hybrid_VM_dataDiskSpace_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Hybrid VM Data Disk Space Alert\",\n \"description\": \"Policy to audit/deploy VM data Disk Space Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Hybrid Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"10\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.HybridCompute/machines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMLowDataDiskSpaceAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-FreeSpacePercentage-Data-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-FreeSpacePercentage-Data-threshold-override_\\\", tostring(tags.[\\\"_amba-FreeSpacePercentage-Data-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HybridVMdataDiskSpaceAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-HybridVMLowDataDiskSpaceAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMLowDataDiskSpaceAlert')]\",\n \"description\": \"Log Alert for Virtual Machine dataDiskSpace\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.HybridCompute/machines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-FreeSpacePercentage-Data-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-FreeSpacePercentage-Data-threshold-override_\\\", tostring(tags.[\\\"_amba-FreeSpacePercentage-Data-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"Disk\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#10": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Hybrid_VM_Memory_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Hybrid VM Memory Alert\",\n \"description\": \"Policy to audit/deploy VM Memory Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Hybrid Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"10\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.HybridCompute/machines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMLowMemoryAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-AvailableMemoryPercentage-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Memory\\\" and Name == \\\"AvailableMB\\\" | extend TotalMemory = toreal(todynamic(Tags)[\\\"vm.azm.ms/memorySizeMB\\\"]) | extend AvailableMemoryPercentage = (toreal(Val) / TotalMemory) * 100.0 | summarize AggregatedValue = avg(AvailableMemoryPercentage) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-AvailableMemoryPercentage-threshold-override_\\\", tostring(tags.[\\\"_amba-AvailableMemoryPercentage-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HybridVMMemoryAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-HybridVMLowMemoryAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMLowMemoryAlert')]\",\n \"description\": \"Log Alert for Virtual Machine Memory\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.HybridCompute/machines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-AvailableMemoryPercentage-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Memory\\\" and Name == \\\"AvailableMB\\\" | extend TotalMemory = toreal(todynamic(Tags)[\\\"vm.azm.ms/memorySizeMB\\\"]) | extend AvailableMemoryPercentage = (toreal(Val) / TotalMemory) * 100.0 | summarize AggregatedValue = avg(AvailableMemoryPercentage) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-AvailableMemoryPercentage-threshold-override_\\\", tostring(tags.[\\\"_amba-AvailableMemoryPercentage-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#11": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Hybrid_VM_Disconnected_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Hybrid VM Disconnected Alert\",\n \"description\": \"Policy to Deploy Hybrid VM Disconnected Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Hybrid Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"1\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"P1D\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT10M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT2H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT10M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"defaultValue\": \"10m\",\n \"allowedValues\": [\n \"5m\",\n \"10m\",\n \"15m\",\n \"30m\",\n \"1h\",\n \"2h\",\n \"3h\",\n \"6h\",\n \"12h\",\n \"1d\",\n \"2d\",\n \"3d\",\n \"7d\"\n ],\n \"metadata\": {\n \"displayName\": \"Hybrid VM Disconnected Threshold (expressed in timespan)\",\n \"description\": \"Threshold in timespan value for the Hybrid VM Disconnected alert\"\n }\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.HybridCompute/machines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMDisconnectedAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | where parse_json(tostring(tags.{0})) !in~ (\\\"{1}\\\") | where tostring(properties.status) == \\\"Disconnected\\\" | extend appliedThresholdString = iif(tags contains \\\"_amba-Disconnected-threshold-override_\\\", tostring(tags.[\\\"_amba-Disconnected-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = totimespan(appliedThresholdString) | extend lastContactedDate = todatetime(properties.lastStatusChange) | where lastContactedDate >= ago(appliedThreshold) | extend status = tostring(properties.status) | project id, Computer=name, status, lastContactedDate', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HybridVMDisconnectedAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-HybridVMDisconnectedAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMDisconnectedAlert')]\",\n \"description\": \"Hybrid VM in disconnected state. Not being connected, prevents extensions to be correctly managed from the portal and Azure policies to be correctly applied. Ensure that both server the specific service (Azure Hybrid Instance Metadata Service on Windows or azcmagent on Linux) are running.\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.HybridCompute/machines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | where parse_json(tostring(tags.{0})) !in~ (\\\"{1}\\\") | where tostring(properties.status) == \\\"Disconnected\\\" | extend lastContactedDate = todatetime(properties.lastStatusChange) | where lastContactedDate <= ago(totimespan(policyThresholdString)) | extend status = tostring(properties.status) | project id, Computer=name, status, lastContactedDate', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"resourceIdColumn\": \"id\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"false\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#12": { + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "name": "Alerting-HybridVM", + "properties": { + "displayName": "Deploy Azure Monitor Baseline Alerts for Hybrid VMs", + "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Azure Arc-enabled Servers.", + "metadata": { + "version": "1.1.0", + "category": "Monitoring", + "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", + "alzCloudEnvironments": [ + "AzureCloud" + ], + "_deployed_by_amba": true + }, + "parameters": { + "ALZMonitorResourceGroupName": { + "type": "String", + "defaultValue": "ALZ-Monitoring-RG", + "metadata": { + "displayName": "ALZ Monitor Resource Group Name", + "description": "Name of the resource group where the ALZ Monitor resources will be deployed" + } + }, + "ALZMonitorResourceGroupTags": { + "type": "Object", + "defaultValue": { + "_deployed_by_alz_monitor": true + }, + "metadata": { + "displayName": "ALZ Monitor Resource Group Tags", + "description": "Tags for the resource group where the ALZ Monitor resources will be deployed" + } + }, + "ALZMonitorResourceGroupLocation": { + "type": "String", + "defaultValue": "centralus", + "metadata": { + "displayName": "ALZ Monitor Resource Group Location", + "description": "Location of the resource group where the ALZ Monitor resources will be deployed" + } + }, + "ALZMonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": "MonitorDisable" + }, + "ALZMonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] + }, + "ALZUserAssignedManagedIdentityName": { + "type": "string", + "defaultValue": "id-AMBA-ARG-Reader-001", + "metadata": { + "description": "The name of the user assigned managed identity to be created for monitoring purpose.", + "displayName": "Name of the user assigned managed identity to be created." + } + }, + "ALZManagementSubscriptionId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "The subscription ID of the management subscription where the user assigned managed identity will be created." + } + }, + "BYOUserAssignedManagedIdentityResourceId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "The resource Id of the user assigned managed identity provided by the customer.", + "displayName": "Customer defined User Assigned managed Identity resource Id." + } + }, + "HybridVMHeartBeatRGAlertSeverity": { + "type": "String", + "defaultValue": "1", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "Hybrid VM Heart Beat RG Alert Severity", + "description": "Severity of the alert for VM Heart Beat RG" + } + }, + "HybridVMHeartBeatRGWindowSize": { + "type": "string", + "defaultValue": "PT15M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "Hybrid VM Heart Beat RG Window Size", + "description": "Window size for the alert" + } + }, + "HybridVMHeartBeatRGEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "Hybrid VM Heart Beat RG Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "HybridVMHeartBeatRGAutoMitigate": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Hybrid VM Heart Beat RG Auto Mitigate", + "description": "Auto Mitigate for the alert" + } + }, + "HybridVMHeartBeatRGAutoResolve": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Hybrid VM Heart Beat RG Auto Resolve", + "description": "Auto Resolve for the alert" + } + }, + "HybridVMHeartBeatRGAutoResolveTime": { + "type": "string", + "defaultValue": "00:10:00", + "metadata": { + "displayName": "Hybrid VM Heart Beat RG Auto Resolve Time", + "description": "Auto Resolve Time for the alert" + } + }, + "HybridVMHeartBeatRGPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Hybrid VM Heart Beat RG Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "HybridVMHeartBeatRGAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Hybrid VM Heart Beat RG Alert State", + "description": "Alert state for the alert" + } + }, + "HybridVMHeartBeatRGThreshold": { + "type": "string", + "defaultValue": "10", + "metadata": { + "displayName": "Hybrid VM Heart Beat RG Threshold", + "description": "Threshold for the alert" + } + }, + "HybridVMHeartBeatRGOperator": { + "type": "string", + "defaultValue": "GreaterThan", + "allowedValues": [ + "GreaterThan" + ], + "metadata": { + "displayName": "Hybrid VM Heart Beat RG Operator", + "description": "Operator for the alert" + } + }, + "HybridVMHeartBeatRGTimeAggregation": { + "type": "string", + "defaultValue": "Count", + "allowedValues": [ + "Count" + ], + "metadata": { + "displayName": "Hybrid VM Heart Beat RG Time Aggregation", + "description": "Time Aggregation for the alert" + } + }, + "HybridVMHeartBeatRGComputersToInclude": { + "type": "array", + "defaultValue": [ + "*" + ], + "metadata": { + "displayName": "Hybrid VM Heart Beat RG Computers To Include", + "description": "Computers To Include for the alert" + } + }, + "HybridVMHeartBeatRGFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "HybridVM Heart Beat RG Failing Periods", + "description": "Failing Periods for the alert" + } + }, + "HybridVMNetworkInAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "Hybrid VM Network In Alert Severity", + "description": "Severity of the alert for VM Network In" + } + }, + "HybridVMNetworkInWindowSize": { + "type": "string", + "defaultValue": "PT15M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "Hybrid VM Network In Window Size", + "description": "Window size for the alert" + } + }, + "HybridVMNetworkInEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "Hybrid VM Network In Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "HybridVMNetworkInAutoMitigate": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Hybrid VM Network In Auto Mitigate", + "description": "Auto Mitigate for the alert" + } + }, + "HybridVMNetworkInAutoResolve": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Hybrid VM Network In Auto Resolve", + "description": "Auto Resolve for the alert" + } + }, + "HybridVMNetworkInAutoResolveTime": { + "type": "string", + "defaultValue": "00:10:00", + "metadata": { + "displayName": "Hybrid VM Network In Auto Resolve Time", + "description": "Auto Resolve Time for the alert" + } + }, + "HybridVMNetworkInPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Hybrid VM Network In Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "HybridVMNetworkInAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Hybrid VM Network In Alert State", + "description": "Alert state for the alert" + } + }, + "HybridVMNetworkInThreshold": { + "type": "string", + "defaultValue": "10000000", + "metadata": { + "displayName": "Hybrid VM Network In Threshold", + "description": "Threshold for the alert" + } + }, + "HybridVMNetworkInOperator": { + "type": "string", + "defaultValue": "GreaterThan", + "allowedValues": [ + "GreaterThan" + ], + "metadata": { + "displayName": "Hybrid VM Network In Operator", + "description": "Operator for the alert" + } + }, + "HybridVMNetworkInTimeAggregation": { + "type": "string", + "defaultValue": "Count", + "allowedValues": [ + "Count" + ], + "metadata": { + "displayName": "Hybrid VM Network In Time Aggregation", + "description": "Time Aggregation for the alert" + } + }, + "HybridVMNetworkInEvaluationPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "Hybrid VM Network In Evaluation Periods", + "description": "Evaluation Periods for the alert" + } + }, + "HybridVMNetworkInFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "Hybrid VM Network In Failing Periods", + "description": "Failing Periods for the alert" + } + }, + "HybridVMNetworkInComputersToInclude": { + "type": "array", + "defaultValue": [ + "*" + ], + "metadata": { + "displayName": "Hybrid VM Network In Computers To Include", + "description": "Computers To Include for the alert" + } + }, + "HybridVMNetworkOutAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "Hybrid VM Network Out Alert Severity", + "description": "Severity of the alert for VM Network Out" + } + }, + "HybridVMNetworkOutWindowSize": { + "type": "string", + "defaultValue": "PT15M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "Hybrid VM Network Out Window Size", + "description": "Window size for the alert" + } + }, + "HybridVMNetworkOutEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "Hybrid VM Network Out Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "HybridVMNetworkOutAutoMitigate": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Hybrid VM Network Out Auto Mitigate", + "description": "Auto Mitigate for the alert" + } + }, + "HybridVMNetworkOutAutoResolve": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Hybrid VM Network Out Auto Resolve", + "description": "Auto Resolve for the alert" + } + }, + "HybridVMNetworkOutAutoResolveTime": { + "type": "string", + "defaultValue": "00:10:00", + "metadata": { + "displayName": "Hybrid VM Network Out Auto Resolve Time", + "description": "Auto Resolve Time for the alert" + } + }, + "HybridVMNetworkOutPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Hybrid VM Network Out Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "HybridVMNetworkOutAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Hybrid VM Network Out Alert State", + "description": "Alert state for the alert, true will enable the alert, false will disable the alert" + } + }, + "HybridVMNetworkOutThreshold": { + "type": "string", + "defaultValue": "10000000", + "metadata": { + "displayName": "Hybrid VM Network Out Threshold", + "description": "Threshold for the alert" + } + }, + "HybridVMNetworkOutOperator": { + "type": "string", + "defaultValue": "GreaterThan", + "allowedValues": [ + "GreaterThan" + ], + "metadata": { + "displayName": "Hybrid VM Network Out Operator", + "description": "Operator for the alert" + } + }, + "HybridVMNetworkOutTimeAggregation": { + "type": "string", + "defaultValue": "Count", + "allowedValues": [ + "Count" + ], + "metadata": { + "displayName": "Hybrid VM Network Out Time Aggregation", + "description": "Time Aggregation for the alert" + } + }, + "HybridVMNetworkOutEvaluationPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "Hybrid VM Network Out Evaluation Periods", + "description": "Evaluation Periods for the alert" + } + }, + "HybridVMNetworkOutFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "Hybrid VM Network Out Failing Periods", + "description": "Failing Periods for the alert" + } + }, + "HybridVMNetworkOutComputersToInclude": { + "type": "array", + "defaultValue": [ + "*" + ], + "metadata": { + "displayName": "Hybrid VM Network Out Computers To Include", + "description": "Computers To Include for the alert" + } + }, + "HybridVMOSDiskReadLatencyAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "Hybrid VM OS Disk Read Latency Alert Severity", + "description": "Severity of the alert for VM OS Disk Read Latency" + } + }, + "HybridVMOSDiskReadLatencyWindowSize": { + "type": "string", + "defaultValue": "PT15M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "Hybrid VM OS Disk Read Latency Window Size", + "description": "Window size for the alert" + } + }, + "HybridVMOSDiskReadLatencyEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "Hybrid VM OS Disk Read Latency Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "HybridVMOSDiskReadLatencyAutoMitigate": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Hybrid VM OS Disk Read Latency Auto Mitigate", + "description": "Auto Mitigate for the alert" + } + }, + "HybridVMOSDiskReadLatencyAutoResolve": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Hybrid VM OS Disk Read Latency Auto Resolve", + "description": "Auto Resolve for the alert" + } + }, + "HybridVMOSDiskReadLatencyAutoResolveTime": { + "type": "string", + "defaultValue": "00:10:00", + "metadata": { + "displayName": "Hybrid VM OS Disk Read Latency Auto Resolve Time", + "description": "Auto Resolve Time for the alert" + } + }, + "HybridVMOSDiskReadLatencyPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Hybrid VM OS Disk Read Latency Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "HybridVMOSDiskReadLatencyAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Hybrid VM OS Disk Read Latency Alert State", + "description": "Alert state for the alert, true will enable the alert, false will disable the alert" + } + }, + "HybridVMOSDiskReadLatencyThreshold": { + "type": "string", + "defaultValue": "30", + "metadata": { + "displayName": "Hybrid VM OS Disk Read Latency Threshold", + "description": "Threshold for the alert" + } + }, + "HybridVMOSDiskReadLatencyOperator": { + "type": "string", + "defaultValue": "GreaterThan", + "allowedValues": [ + "GreaterThan" + ], + "metadata": { + "displayName": "Hybrid VM OS Disk Read Latency Operator", + "description": "Operator for the alert" + } + }, + "HybridVMOSDiskReadLatencyTimeAggregation": { + "type": "string", + "defaultValue": "Count", + "allowedValues": [ + "Count" + ], + "metadata": { + "displayName": "Hybrid VM OS Disk Read Latency Time Aggregation", + "description": "Time Aggregation for the alert" + } + }, + "HybridVMOSDiskReadLatencyEvaluationPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "Hybrid VM OS Disk Read Latency Evaluation Periods", + "description": "Evaluation Periods for the alert" + } + }, + "HybridVMOSDiskReadLatencyFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "Hybrid VM OS Disk Read Latency Failing Periods", + "description": "Failing Periods for the alert" + } + }, + "HybridVMOSDiskReadLatencyComputersToInclude": { + "type": "array", + "defaultValue": [ + "*" + ], + "metadata": { + "displayName": "Hybrid VM OS Disk Read Latency Computers To Include", + "description": "Computers To Include for the alert" + } + }, + "HybridVMOSDiskWriteLatencyAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "Hybrid VM OS Disk Write Latency Alert Severity", + "description": "Severity of the alert for VM OS Disk Write Latency" + } + }, + "HybridVMOSDiskWriteLatencyWindowSize": { + "type": "string", + "defaultValue": "PT15M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "Hybrid VM OS Disk Write Latency Window Size", + "description": "Window size for the alert" + } + }, + "HybridVMOSDiskWriteLatencyEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "Hybrid VM OS Disk Write Latency Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "HybridVMOSDiskWriteLatencyAutoMitigate": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Hybrid VM OS Disk Write Latency Auto Mitigate", + "description": "Auto Mitigate for the alert" + } + }, + "HybridVMOSDiskWriteLatencyAutoResolve": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Hybrid VM OS Disk Write Latency Auto Resolve", + "description": "Auto Resolve for the alert" + } + }, + "HybridVMOSDiskWriteLatencyAutoResolveTime": { + "type": "string", + "defaultValue": "00:10:00", + "metadata": { + "displayName": "Hybrid VM OS Disk Write Latency Auto Resolve Time", + "description": "Auto Resolve Time for the alert" + } + }, + "HybridVMOSDiskWriteLatencyPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Hybrid VM OS Disk Write Latency Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "HybridVMOSDiskWriteLatencyAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Hybrid VM OS Disk Write Latency Alert State", + "description": "Alert state for the alert, true will enable the alert, false will disable the alert" + } + }, + "HybridVMOSDiskWriteLatencyThreshold": { + "type": "string", + "defaultValue": "50", + "metadata": { + "displayName": "Hybrid VM OS Disk Write Latency Threshold", + "description": "Threshold for the alert" + } + }, + "HybridVMOSDiskWriteLatencyOperator": { + "type": "string", + "defaultValue": "GreaterThan", + "allowedValues": [ + "GreaterThan" + ], + "metadata": { + "displayName": "Hybrid VM OS Disk Write Latency Operator", + "description": "Operator for the alert" + } + }, + "HybridVMOSDiskWriteLatencyTimeAggregation": { + "type": "string", + "defaultValue": "Count", + "allowedValues": [ + "Count" + ], + "metadata": { + "displayName": "Hybrid VM OS Disk Write Latency Time Aggregation", + "description": "Time Aggregation for the alert" + } + }, + "HybridVMOSDiskWriteLatencyEvaluationPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "Hybrid VM OS Disk Write Latency Evaluation Periods", + "description": "Evaluation Periods for the alert" + } + }, + "HybridVMOSDiskWriteLatencyFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "Hybrid VM OS Disk Write Latency Failing Periods", + "description": "Failing Periods for the alert" + } + }, + "HybridVMOSDiskWriteLatencyComputersToInclude": { + "type": "array", + "defaultValue": [ + "*" + ], + "metadata": { + "displayName": "Hybrid VM OS Disk Write Latency Computers To Include", + "description": "Computers To Include for the alert" + } + }, + "HybridVMOSDiskSpaceAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "Hybrid VM OS Disk Space Alert Severity", + "description": "Severity of the alert for VM OS Disk Space" + } + }, + "HybridVMOSDiskSpaceWindowSize": { + "type": "string", + "defaultValue": "PT15M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "Hybrid VM OS Disk Space Window Size", + "description": "Window size for the alert" + } + }, + "HybridVMOSDiskSpaceEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "Hybrid VM OS Disk Space Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "HybridVMOSDiskSpaceAutoMitigate": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Hybrid VM OS Disk Space Auto Mitigate", + "description": "Auto Mitigate for the alert" + } + }, + "HybridVMOSDiskSpaceAutoResolve": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Hybrid VM OS Disk Space Auto Resolve", + "description": "Auto Resolve for the alert" + } + }, + "HybridVMOSDiskSpaceAutoResolveTime": { + "type": "string", + "defaultValue": "00:10:00", + "metadata": { + "displayName": "Hybrid VM OS Disk Space Auto Resolve Time", + "description": "Auto Resolve Time for the alert" + } + }, + "HybridVMOSDiskSpacePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Hybrid VM OS Disk Space Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "HybridVMOSDiskSpaceAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Hybrid VM OS Disk Space Alert State", + "description": "Alert state for the alert, true will enable the alert, false will disable the alert" + } + }, + "HybridVMOSDiskSpaceThreshold": { + "type": "string", + "defaultValue": "10", + "metadata": { + "displayName": "Hybrid VM OS Disk Space Threshold", + "description": "Threshold for the alert" + } + }, + "HybridVMOSDiskSpaceOperator": { + "type": "string", + "defaultValue": "GreaterThan", + "allowedValues": [ + "GreaterThan" + ], + "metadata": { + "displayName": "Hybrid VM OS Disk Space Operator", + "description": "Operator for the alert" + } + }, + "HybridVMOSDiskSpaceTimeAggregation": { + "type": "string", + "defaultValue": "Count", + "allowedValues": [ + "Count" + ], + "metadata": { + "displayName": "Hybrid VM OS Disk Space Time Aggregation", + "description": "Time Aggregation for the alert" + } + }, + "HybridVMOSDiskSpaceEvaluationPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "Hybrid VM OS Disk Space Evaluation Periods", + "description": "Evaluation Periods for the alert" + } + }, + "HybridVMOSDiskSpaceFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "Hybrid VM OS Disk Space Failing Periods", + "description": "Failing Periods for the alert" + } + }, + "HybridVMOSDiskSpaceComputersToInclude": { + "type": "array", + "defaultValue": [ + "*" + ], + "metadata": { + "displayName": "Hybrid VM OS Disk Space Computers To Include", + "description": "Computers To Include for the alert" + } + }, + "HybridVMPercentCPUAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "Hybrid VM Percent CPU Alert Severity", + "description": "Severity of the alert for VM Percent CPU" + } + }, + "HybridVMPercentCPUWindowSize": { + "type": "string", + "defaultValue": "PT15M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "Hybrid VM Percent CPU Window Size", + "description": "Window size for the alert" + } + }, + "HybridVMPercentCPUEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "Hybrid VM Percent CPU Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "HybridVMPercentCPUAutoMitigate": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Hybrid VM Percent CPU Auto Mitigate", + "description": "Auto Mitigate for the alert" + } + }, + "HybridVMPercentCPUAutoResolve": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Hybrid VM Percent CPU Auto Resolve", + "description": "Auto Resolve for the alert" + } + }, + "HybridVMPercentCPUAutoResolveTime": { + "type": "string", + "defaultValue": "00:10:00", + "metadata": { + "displayName": "Hybrid VM Percent CPU Auto Resolve Time", + "description": "Auto Resolve Time for the alert" + } + }, + "HybridVMPercentCPUPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Hybrid VM Percent CPU Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "HybridVMPercentCPUAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Hybrid VM Percent CPU Alert State", + "description": "Alert state for the alert, true will enable the alert, false will disable the alert" + } + }, + "HybridVMPercentCPUThreshold": { + "type": "string", + "defaultValue": "85", + "metadata": { + "displayName": "Hybrid VM Percent CPU Threshold", + "description": "Threshold for the alert" + } + }, + "HybridVMPercentCPUOperator": { + "type": "string", + "defaultValue": "GreaterThan", + "allowedValues": [ + "GreaterThan" + ], + "metadata": { + "displayName": "Hybrid VM Percent CPU Operator", + "description": "Operator for the alert" + } + }, + "HybridVMPercentCPUTimeAggregation": { + "type": "string", + "defaultValue": "Count", + "allowedValues": [ + "Count" + ], + "metadata": { + "displayName": "Hybrid VM Percent CPU Time Aggregation", + "description": "Time Aggregation for the alert" + } + }, + "HybridVMPercentCPUFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "Hybrid VM Percent CPU Failing Periods", + "description": "Failing Periods for the alert" + } + }, + "HybridVMPercentMemoryAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "Hybrid VM Percent Memory Alert Severity", + "description": "Severity of the alert for VM Percent Memory" + } + }, + "HybridVMPercentMemoryWindowSize": { + "type": "string", + "defaultValue": "PT15M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "Hybrid VM Percent Memory Window Size", + "description": "Window size for the alert" + } + }, + "HybridVMPercentMemoryEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "Hybrid VM Percent Memory Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "HybridVMPercentMemoryAutoMitigate": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Hybrid VM Percent Memory Auto Mitigate", + "description": "Auto Mitigate for the alert" + } + }, + "HybridVMPercentMemoryAutoResolve": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Hybrid VM Percent Memory Auto Resolve", + "description": "Auto Resolve for the alert" + } + }, + "HybridVMPercentMemoryAutoResolveTime": { + "type": "string", + "defaultValue": "00:10:00", + "metadata": { + "displayName": "Hybrid VM Percent Memory Auto Resolve Time", + "description": "Auto Resolve Time for the alert" + } + }, + "HybridVMPercentMemoryPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Hybrid VM Percent Memory Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "HybridVMPercentMemoryAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Hybrid VM Percent Memory Alert State", + "description": "Alert state for the alert, true will enable the alert, false will disable the alert" + } + }, + "HybridVMPercentMemoryThreshold": { + "type": "string", + "defaultValue": "10", + "metadata": { + "displayName": "Hybrid VM Percent Memory Threshold", + "description": "Threshold for the alert" + } + }, + "HybridVMPercentMemoryOperator": { + "type": "string", + "defaultValue": "GreaterThan", + "allowedValues": [ + "GreaterThan" + ], + "metadata": { + "displayName": "Hybrid VM Percent Memory Operator", + "description": "Operator for the alert" + } + }, + "HybridVMPercentMemoryTimeAggregation": { + "type": "string", + "defaultValue": "Count", + "allowedValues": [ + "Count" + ], + "metadata": { + "displayName": "Hybrid VM Percent Memory Time Aggregation", + "description": "Time Aggregation for the alert" + } + }, + "HybridVMPercentMemoryFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "Hybrid VM Percent Memory Failing Periods", + "description": "Failing Periods for the alert" + } + }, + "HybridVMDataDiskSpaceAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "Hybrid VM Data Disk Space Alert Severity", + "description": "Severity of the alert for VM Data Disk Space" + } + }, + "HybridVMDataDiskSpaceWindowSize": { + "type": "string", + "defaultValue": "PT15M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "Hybrid VM Data Disk Space Window Size", + "description": "Window size for the alert" + } + }, + "HybridVMDataDiskSpaceEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "Hybrid VM Data Disk Space Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "HybridVMDataDiskSpaceAutoMitigate": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Hybrid VM Data Disk Space Auto Mitigate", + "description": "Auto Mitigate for the alert" + } + }, + "HybridVMDataDiskSpaceAutoResolve": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Hybrid VM Data Disk Space Auto Resolve", + "description": "Auto Resolve for the alert" + } + }, + "HybridVMDataDiskSpaceAutoResolveTime": { + "type": "string", + "defaultValue": "00:10:00", + "metadata": { + "displayName": "Hybrid VM Data Disk Space Auto Resolve Time", + "description": "Auto Resolve Time for the alert" + } + }, + "HybridVMDataDiskSpacePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Hybrid VM Data Disk Space Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "HybridVMDataDiskSpaceAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Hybrid VM Data Disk Space Alert State", + "description": "Alert state for the alert, true will enable the alert, false will disable the alert" + } + }, + "HybridVMDataDiskSpaceThreshold": { + "type": "string", + "defaultValue": "10", + "metadata": { + "displayName": "Hybrid VM Data Disk Space Threshold", + "description": "Threshold for the alert" + } + }, + "HybridVMDataDiskSpaceOperator": { + "type": "string", + "defaultValue": "GreaterThan", + "allowedValues": [ + "GreaterThan" + ], + "metadata": { + "displayName": "Hybrid VM Data Disk Space Operator", + "description": "Operator for the alert" + } + }, + "HybridVMDataDiskSpaceTimeAggregation": { + "type": "string", + "defaultValue": "Count", + "allowedValues": [ + "Count" + ], + "metadata": { + "displayName": "Hybrid VM Data Disk Space Time Aggregation", + "description": "Time Aggregation for the alert" + } + }, + "HybridVMDataDiskSpaceEvaluationPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "Hybrid VM Data Disk Space Evaluation Periods", + "description": "Evaluation Periods for the alert" + } + }, + "HybridVMDataDiskSpaceFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "Hybrid VM Data Disk Space Failing Periods", + "description": "Failing Periods for the alert" + } + }, + "HybridVMDataDiskSpaceComputersToInclude": { + "type": "array", + "defaultValue": [ + "*" + ], + "metadata": { + "displayName": "Hybrid VM Data Disk Space Computers To Include", + "description": "Computers To Include for the alert" + } + }, + "HybridVMDataDiskReadLatencyAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "Hybrid VM Data Disk Read Latency Alert Severity", + "description": "Severity of the alert for VM Data Disk Read Latency" + } + }, + "HybridVMDataDiskReadLatencyWindowSize": { + "type": "string", + "defaultValue": "PT15M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "Hybrid VM Data Disk Read Latency Window Size", + "description": "Window size for the alert" + } + }, + "HybridVMDataDiskReadLatencyEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "Hybrid VM Data Disk Read Latency Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "HybridVMDataDiskReadLatencyAutoMitigate": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Hybrid VM Data Disk Read Latency Auto Mitigate", + "description": "Auto Mitigate for the alert" + } + }, + "HybridVMDataDiskReadLatencyAutoResolve": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Hybrid VM Data Disk Read Latency Auto Resolve", + "description": "Auto Resolve for the alert" + } + }, + "HybridVMDataDiskReadLatencyAutoResolveTime": { + "type": "string", + "defaultValue": "00:10:00", + "metadata": { + "displayName": "Hybrid VM Data Disk Read Latency Auto Resolve Time", + "description": "Auto Resolve Time for the alert" + } + }, + "HybridVMDataDiskReadLatencyPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Hybrid VM Data Disk Read Latency Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "HybridVMDataDiskReadLatencyAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Hybrid VM Data Disk Read Latency Alert State", + "description": "Alert state for the alert, true will enable the alert, false will disable the alert" + } + }, + "HybridVMDataDiskReadLatencyThreshold": { + "type": "string", + "defaultValue": "30", + "metadata": { + "displayName": "Hybrid VM Data Disk Read Latency Threshold", + "description": "Threshold for the alert" + } + }, + "HybridVMDataDiskReadLatencyOperator": { + "type": "string", + "defaultValue": "GreaterThan", + "allowedValues": [ + "GreaterThan" + ], + "metadata": { + "displayName": "Hybrid VM Data Disk Read Latency Operator", + "description": "Operator for the alert" + } + }, + "HybridVMDataDiskReadLatencyTimeAggregation": { + "type": "string", + "defaultValue": "Count", + "allowedValues": [ + "Count" + ], + "metadata": { + "displayName": "Hybrid VM Data Disk Read Latency Time Aggregation", + "description": "Time Aggregation for the alert" + } + }, + "HybridVMDataDiskReadLatencyEvaluationPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "Hybrid VM Data Disk Read Latency Evaluation Periods", + "description": "Evaluation Periods for the alert" + } + }, + "HybridVMDataDiskReadLatencyFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "Hybrid VM Data Disk Read Latency Failing Periods", + "description": "Failing Periods for the alert" + } + }, + "HybridVMDataDiskReadLatencyComputersToInclude": { + "type": "array", + "defaultValue": [ + "*" + ], + "metadata": { + "displayName": "Hybrid VM Data Disk Read Latency Computers To Include", + "description": "Computers To Include for the alert" + } + }, + "HybridVMDataDiskWriteLatencyAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "Hybrid VM Data Disk Write Latency Alert Severity", + "description": "Severity of the alert for VM Data Disk Write Latency" + } + }, + "HybridVMDataDiskWriteLatencyWindowSize": { + "type": "string", + "defaultValue": "PT15M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "Hybrid VM Data Disk Write Latency Window Size", + "description": "Window size for the alert" + } + }, + "HybridVMDataDiskWriteLatencyEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "Hybrid VM Data Disk Write Latency Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "HybridVMDataDiskWriteLatencyAutoMitigate": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Hybrid VM Data Disk Write Latency Auto Mitigate", + "description": "Auto Mitigate for the alert" + } + }, + "HybridVMDataDiskWriteLatencyAutoResolve": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Hybrid VM Data Disk Write Latency Auto Resolve", + "description": "Auto Resolve for the alert" + } + }, + "HybridVMDataDiskWriteLatencyAutoResolveTime": { + "type": "string", + "defaultValue": "00:10:00", + "metadata": { + "displayName": "Hybrid VM Data Disk Write Latency Auto Resolve Time", + "description": "Auto Resolve Time for the alert" + } + }, + "HybridVMDataDiskWriteLatencyPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Hybrid VM Data Disk Write Latency Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "HybridVMDataDiskWriteLatencyAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Hybrid VM Data Disk Write Latency Alert State", + "description": "Alert state for the alert, true will enable the alert, false will disable the alert" + } + }, + "HybridVMDataDiskWriteLatencyThreshold": { + "type": "string", + "defaultValue": "30", + "metadata": { + "displayName": "Hybrid VM Data Disk Write Latency Threshold", + "description": "Threshold for the alert" + } + }, + "HybridVMDataDiskWriteLatencyOperator": { + "type": "string", + "defaultValue": "GreaterThan", + "allowedValues": [ + "GreaterThan" + ], + "metadata": { + "displayName": "Hybrid VM Data Disk Write Latency Operator", + "description": "Operator for the alert" + } + }, + "HybridVMDataDiskWriteLatencyTimeAggregation": { + "type": "string", + "defaultValue": "Count", + "allowedValues": [ + "Count" + ], + "metadata": { + "displayName": "Hybrid VM Data Disk Write Latency Time Aggregation", + "description": "Time Aggregation for the alert" + } + }, + "HybridVMDataDiskWriteLatencyEvaluationPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "Hybrid VM Data Disk Write Latency Evaluation Periods", + "description": "Evaluation Periods for the alert" + } + }, + "HybridVMDataDiskWriteLatencyFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "Hybrid VM Data Disk Write Latency Failing Periods", + "description": "Failing Periods for the alert" + } + }, + "HybridVMDataDiskWriteLatencyComputersToInclude": { + "type": "array", + "defaultValue": [ + "*" + ], + "metadata": { + "displayName": "Hybrid VM Data Disk Write Latency Computers To Include", + "description": "Computers To Include for the alert" + } + }, + "HybridVMDisconnectedAlertSeverity": { + "type": "String", + "defaultValue": "1", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "Hybrid VM Disconnected Alert Severity", + "description": "Severity of the Hybrid VM Disconnected alert" + } + }, + "HybridVMDisconnectedAlertWindowSize": { + "type": "string", + "defaultValue": "P1D", + "allowedValues": [ + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "Hybrid VM Disconnected Window Size", + "description": "Window size for the Hybrid VM Disconnected alert" + } + }, + "HybridVMDisconnectedAlertEvaluationFrequency": { + "type": "string", + "defaultValue": "PT10M", + "allowedValues": [ + "PT5M", + "PT10M", + "PT15M", + "PT30M", + "PT1H", + "PT2H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "Hybrid VM Disconnected Evaluation Frequency", + "description": "Evaluation frequency for the Hybrid VM Disconnected alert" + } + }, + "HybridVMDisconnectedAlertAutoMitigate": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Hybrid VM Disconnected Auto Mitigate", + "description": "Auto Mitigate for the Hybrid VM Disconnected alert" + } + }, + "HybridVMDisconnectedAlertPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Hybrid VM Disconnected Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "HybridVMDisconnectedAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Hybrid VM Disconnected Alert State", + "description": "Alert state for the alert, true will enable the alert, false will disable the alert" + } + }, + "HybridVMDisconnectedAlertThreshold": { + "type": "string", + "defaultValue": "10m", + "allowedValues": [ + "5m", + "10m", + "15m", + "30m", + "1h", + "2h", + "3h", + "6h", + "12h", + "1d", + "2d", + "3d", + "7d" + ], + "metadata": { + "displayName": "Hybrid VM Disconnected Threshold (expressed in timespan)", + "description": "Threshold in timespan value for the Hybrid VM Disconnected alert" + } + }, + "HybridVMDisconnectedAlertOperator": { + "type": "string", + "defaultValue": "GreaterThan", + "allowedValues": [ + "GreaterThan" + ], + "metadata": { + "displayName": "Hybrid VM Disconnected Operator", + "description": "Operator for the Hybrid VM Disconnected alert" + } + }, + "HybridVMDisconnectedAlertTimeAggregation": { + "type": "string", + "defaultValue": "Count", + "allowedValues": [ + "Count" + ], + "metadata": { + "displayName": "Hybrid VM Disconnected Time Aggregation", + "description": "Time Aggregation for the Hybrid VM Disconnected alert" + } + }, + "HybridVMDisconnectedAlertEvaluationPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "Hybrid VM Disconnected Evaluation Periods", + "description": "Evaluation Periods for the Hybrid VM Disconnected alert" + } + }, + "HybridVMDisconnectedAlertFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "Hybrid VM Disconnected Failing Periods", + "description": "Failing Periods for the Hybrid VM Disconnected alert" + } + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "ALZ_HybridVMHeartBeatRG", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_Hybrid_VM_HeartBeat_Alert", + "parameters": { + "UAMIResourceId": { + "value": "[[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), concat('/subscriptions/', parameters('ALZManagementSubscriptionId'), '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('ALZUserAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "severity": { + "value": "[[[parameters('HybridVMHeartBeatRGAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('HybridVMHeartBeatRGWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('HybridVMHeartBeatRGEvaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[[parameters('HybridVMHeartBeatRGAutoMitigate')]" + }, + "autoResolve": { + "value": "[[[parameters('HybridVMHeartBeatRGAutoResolve')]" + }, + "autoResolveTime": { + "value": "[[[parameters('HybridVMHeartBeatRGAutoResolveTime')]" + }, + "effect": { + "value": "[[[parameters('HybridVMHeartBeatRGPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('HybridVMHeartBeatRGAlertState')]" + }, + "threshold": { + "value": "[[[parameters('HybridVMHeartBeatRGThreshold')]" + }, + "operator": { + "value": "[[[parameters('HybridVMHeartBeatRGOperator')]" + }, + "timeAggregation": { + "value": "[[[parameters('HybridVMHeartBeatRGTimeAggregation')]" + }, + "computersToInclude": { + "value": "[[[parameters('HybridVMHeartBeatRGComputersToInclude')]" + }, + "failingPeriods": { + "value": "[[[parameters('HybridVMHeartBeatRGFailingPeriods')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_HybridVMNetworkIn", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_Hybrid_VM_NetworkIn_Alert", + "parameters": { + "UAMIResourceId": { + "value": "[[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), concat('/subscriptions/', parameters('ALZManagementSubscriptionId'), '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('ALZUserAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" + }, + "severity": { + "value": "[[[parameters('HybridVMNetworkInAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('HybridVMNetworkInWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('HybridVMNetworkInEvaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[[parameters('HybridVMNetworkInAutoMitigate')]" + }, + "autoResolve": { + "value": "[[[parameters('HybridVMNetworkInAutoResolve')]" + }, + "autoResolveTime": { + "value": "[[[parameters('HybridVMNetworkInAutoResolveTime')]" + }, + "effect": { + "value": "[[[parameters('HybridVMNetworkInPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('HybridVMNetworkInAlertState')]" + }, + "threshold": { + "value": "[[[parameters('HybridVMNetworkInThreshold')]" + }, + "operator": { + "value": "[[[parameters('HybridVMNetworkInOperator')]" + }, + "timeAggregation": { + "value": "[[[parameters('HybridVMNetworkInTimeAggregation')]" + }, + "failingPeriods": { + "value": "[[[parameters('HybridVMNetworkInFailingPeriods')]" + }, + "evaluationPeriods": { + "value": "[[[parameters('HybridVMNetworkInEvaluationPeriods')]" + }, + "computersToInclude": { + "value": "[[[parameters('HybridVMNetworkInComputersToInclude')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_HybridVMNetworkOut", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_Hybrid_VM_NetworkOut_Alert", + "parameters": { + "UAMIResourceId": { + "value": "[[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), concat('/subscriptions/', parameters('ALZManagementSubscriptionId'), '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('ALZUserAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" + }, + "severity": { + "value": "[[[parameters('HybridVMNetworkOutAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('HybridVMNetworkOutWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('HybridVMNetworkOutEvaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[[parameters('HybridVMNetworkOutAutoMitigate')]" + }, + "autoResolve": { + "value": "[[[parameters('HybridVMNetworkOutAutoResolve')]" + }, + "autoResolveTime": { + "value": "[[[parameters('HybridVMNetworkOutAutoResolveTime')]" + }, + "effect": { + "value": "[[[parameters('HybridVMNetworkOutPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('HybridVMNetworkOutAlertState')]" + }, + "threshold": { + "value": "[[[parameters('HybridVMNetworkOutThreshold')]" + }, + "operator": { + "value": "[[[parameters('HybridVMNetworkOutOperator')]" + }, + "timeAggregation": { + "value": "[[[parameters('HybridVMNetworkOutTimeAggregation')]" + }, + "failingPeriods": { + "value": "[[[parameters('HybridVMNetworkOutFailingPeriods')]" + }, + "evaluationPeriods": { + "value": "[[[parameters('HybridVMNetworkOutEvaluationPeriods')]" + }, + "computersToInclude": { + "value": "[[[parameters('HybridVMNetworkOutComputersToInclude')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_HybridVMOSDiskReadLatency", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_Hybrid_VM_OSDiskreadLatency_Alert", + "parameters": { + "UAMIResourceId": { + "value": "[[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), concat('/subscriptions/', parameters('ALZManagementSubscriptionId'), '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('ALZUserAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" + }, + "severity": { + "value": "[[[parameters('HybridVMOSDiskReadLatencyAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('HybridVMOSDiskReadLatencyWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('HybridVMOSDiskReadLatencyEvaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[[parameters('HybridVMOSDiskReadLatencyAutoMitigate')]" + }, + "autoResolve": { + "value": "[[[parameters('HybridVMOSDiskReadLatencyAutoResolve')]" + }, + "autoResolveTime": { + "value": "[[[parameters('HybridVMOSDiskReadLatencyAutoResolveTime')]" + }, + "effect": { + "value": "[[[parameters('HybridVMOSDiskReadLatencyPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('HybridVMOSDiskReadLatencyAlertState')]" + }, + "threshold": { + "value": "[[[parameters('HybridVMOSDiskReadLatencyThreshold')]" + }, + "operator": { + "value": "[[[parameters('HybridVMOSDiskReadLatencyOperator')]" + }, + "timeAggregation": { + "value": "[[[parameters('HybridVMOSDiskReadLatencyTimeAggregation')]" + }, + "failingPeriods": { + "value": "[[[parameters('HybridVMOSDiskReadLatencyFailingPeriods')]" + }, + "evaluationPeriods": { + "value": "[[[parameters('HybridVMOSDiskReadLatencyEvaluationPeriods')]" + }, + "computersToInclude": { + "value": "[[[parameters('HybridVMOSDiskReadLatencyComputersToInclude')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_HybridVMOSDiskWriteLatency", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_Hybrid_VM_OSDiskwriteLatency_Alert", + "parameters": { + "UAMIResourceId": { + "value": "[[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), concat('/subscriptions/', parameters('ALZManagementSubscriptionId'), '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('ALZUserAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" + }, + "severity": { + "value": "[[[parameters('HybridVMOSDiskWriteLatencyAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('HybridVMOSDiskWriteLatencyWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('HybridVMOSDiskWriteLatencyEvaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[[parameters('HybridVMOSDiskWriteLatencyAutoMitigate')]" + }, + "autoResolve": { + "value": "[[[parameters('HybridVMOSDiskWriteLatencyAutoResolve')]" + }, + "autoResolveTime": { + "value": "[[[parameters('HybridVMOSDiskWriteLatencyAutoResolveTime')]" + }, + "effect": { + "value": "[[[parameters('HybridVMOSDiskWriteLatencyPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('HybridVMOSDiskWriteLatencyAlertState')]" + }, + "threshold": { + "value": "[[[parameters('HybridVMOSDiskWriteLatencyThreshold')]" + }, + "operator": { + "value": "[[[parameters('HybridVMOSDiskWriteLatencyOperator')]" + }, + "timeAggregation": { + "value": "[[[parameters('HybridVMOSDiskWriteLatencyTimeAggregation')]" + }, + "failingPeriods": { + "value": "[[[parameters('HybridVMOSDiskWriteLatencyFailingPeriods')]" + }, + "evaluationPeriods": { + "value": "[[[parameters('HybridVMOSDiskWriteLatencyEvaluationPeriods')]" + }, + "computersToInclude": { + "value": "[[[parameters('HybridVMOSDiskWriteLatencyComputersToInclude')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_HybridVMOSDiskSpace", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_Hybrid_VM_OSDiskSpace_Alert", + "parameters": { + "UAMIResourceId": { + "value": "[[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), concat('/subscriptions/', parameters('ALZManagementSubscriptionId'), '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('ALZUserAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" + }, + "severity": { + "value": "[[[parameters('HybridVMOSDiskSpaceAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('HybridVMOSDiskSpaceWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('HybridVMOSDiskSpaceEvaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[[parameters('HybridVMOSDiskSpaceAutoMitigate')]" + }, + "autoResolve": { + "value": "[[[parameters('HybridVMOSDiskSpaceAutoResolve')]" + }, + "autoResolveTime": { + "value": "[[[parameters('HybridVMOSDiskSpaceAutoResolveTime')]" + }, + "effect": { + "value": "[[[parameters('HybridVMOSDiskSpacePolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('HybridVMOSDiskSpaceAlertState')]" + }, + "threshold": { + "value": "[[[parameters('HybridVMOSDiskSpaceThreshold')]" + }, + "operator": { + "value": "[[[parameters('HybridVMOSDiskSpaceOperator')]" + }, + "timeAggregation": { + "value": "[[[parameters('HybridVMOSDiskSpaceTimeAggregation')]" + }, + "failingPeriods": { + "value": "[[[parameters('HybridVMOSDiskSpaceFailingPeriods')]" + }, + "evaluationPeriods": { + "value": "[[[parameters('HybridVMOSDiskSpaceEvaluationPeriods')]" + }, + "computersToInclude": { + "value": "[[[parameters('HybridVMOSDiskSpaceComputersToInclude')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_HybridVMPercentCPU", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_Hybrid_VM_CPU_Alert", + "parameters": { + "UAMIResourceId": { + "value": "[[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), concat('/subscriptions/', parameters('ALZManagementSubscriptionId'), '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('ALZUserAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" + }, + "severity": { + "value": "[[[parameters('HybridVMPercentCPUAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('HybridVMPercentCPUWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('HybridVMPercentCPUEvaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[[parameters('HybridVMPercentCPUAutoMitigate')]" + }, + "autoResolve": { + "value": "[[[parameters('HybridVMPercentCPUAutoResolve')]" + }, + "autoResolveTime": { + "value": "[[[parameters('HybridVMPercentCPUAutoResolveTime')]" + }, + "effect": { + "value": "[[[parameters('HybridVMPercentCPUPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('HybridVMPercentCPUAlertState')]" + }, + "threshold": { + "value": "[[[parameters('HybridVMPercentCPUThreshold')]" + }, + "operator": { + "value": "[[[parameters('HybridVMPercentCPUOperator')]" + }, + "timeAggregation": { + "value": "[[[parameters('HybridVMPercentCPUTimeAggregation')]" + }, + "failingPeriods": { + "value": "[[[parameters('HybridVMPercentCPUFailingPeriods')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_HybridVMPercentMemory", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_Hybrid_VM_Memory_Alert", + "parameters": { + "UAMIResourceId": { + "value": "[[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), concat('/subscriptions/', parameters('ALZManagementSubscriptionId'), '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('ALZUserAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" + }, + "severity": { + "value": "[[[parameters('HybridVMPercentMemoryAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('HybridVMPercentMemoryWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('HybridVMPercentMemoryEvaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[[parameters('HybridVMPercentMemoryAutoMitigate')]" + }, + "autoResolve": { + "value": "[[[parameters('HybridVMPercentMemoryAutoResolve')]" + }, + "autoResolveTime": { + "value": "[[[parameters('HybridVMPercentMemoryAutoResolveTime')]" + }, + "effect": { + "value": "[[[parameters('HybridVMPercentMemoryPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('HybridVMPercentMemoryAlertState')]" + }, + "threshold": { + "value": "[[[parameters('HybridVMPercentMemoryThreshold')]" + }, + "operator": { + "value": "[[[parameters('HybridVMPercentMemoryOperator')]" + }, + "timeAggregation": { + "value": "[[[parameters('HybridVMPercentMemoryTimeAggregation')]" + }, + "failingPeriods": { + "value": "[[[parameters('HybridVMPercentMemoryFailingPeriods')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_HybridVMDataDiskSpace", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_Hybrid_VM_dataDiskSpace_Alert", + "parameters": { + "UAMIResourceId": { + "value": "[[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), concat('/subscriptions/', parameters('ALZManagementSubscriptionId'), '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('ALZUserAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" + }, + "severity": { + "value": "[[[parameters('HybridVMDataDiskSpaceAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('HybridVMDataDiskSpaceWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('HybridVMDataDiskSpaceEvaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[[parameters('HybridVMDataDiskSpaceAutoMitigate')]" + }, + "autoResolve": { + "value": "[[[parameters('HybridVMDataDiskSpaceAutoResolve')]" + }, + "autoResolveTime": { + "value": "[[[parameters('HybridVMDataDiskSpaceAutoResolveTime')]" + }, + "effect": { + "value": "[[[parameters('HybridVMDataDiskSpacePolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('HybridVMDataDiskSpaceAlertState')]" + }, + "threshold": { + "value": "[[[parameters('HybridVMDataDiskSpaceThreshold')]" + }, + "operator": { + "value": "[[[parameters('HybridVMDataDiskSpaceOperator')]" + }, + "timeAggregation": { + "value": "[[[parameters('HybridVMDataDiskSpaceTimeAggregation')]" + }, + "failingPeriods": { + "value": "[[[parameters('HybridVMDataDiskSpaceFailingPeriods')]" + }, + "evaluationPeriods": { + "value": "[[[parameters('HybridVMDataDiskSpaceEvaluationPeriods')]" + }, + "computersToInclude": { + "value": "[[[parameters('HybridVMDataDiskSpaceComputersToInclude')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_HybridVMDataDiskReadLatency", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_Hybrid_VM_dataDiskReadLatency_Alert", + "parameters": { + "UAMIResourceId": { + "value": "[[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), concat('/subscriptions/', parameters('ALZManagementSubscriptionId'), '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('ALZUserAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" + }, + "severity": { + "value": "[[[parameters('HybridVMDataDiskReadLatencyAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('HybridVMDataDiskReadLatencyWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('HybridVMDataDiskReadLatencyEvaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[[parameters('HybridVMDataDiskReadLatencyAutoMitigate')]" + }, + "autoResolve": { + "value": "[[[parameters('HybridVMDataDiskReadLatencyAutoResolve')]" + }, + "autoResolveTime": { + "value": "[[[parameters('HybridVMDataDiskReadLatencyAutoResolveTime')]" + }, + "effect": { + "value": "[[[parameters('HybridVMDataDiskReadLatencyPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('HybridVMDataDiskReadLatencyAlertState')]" + }, + "threshold": { + "value": "[[[parameters('HybridVMDataDiskReadLatencyThreshold')]" + }, + "operator": { + "value": "[[[parameters('HybridVMDataDiskReadLatencyOperator')]" + }, + "timeAggregation": { + "value": "[[[parameters('HybridVMDataDiskReadLatencyTimeAggregation')]" + }, + "failingPeriods": { + "value": "[[[parameters('HybridVMDataDiskReadLatencyFailingPeriods')]" + }, + "evaluationPeriods": { + "value": "[[[parameters('HybridVMDataDiskReadLatencyEvaluationPeriods')]" + }, + "computersToInclude": { + "value": "[[[parameters('HybridVMDataDiskReadLatencyComputersToInclude')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_HybridVMDataDiskWriteLatency", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_Hybrid_VM_dataDiskWriteLatency_Alert", + "parameters": { + "UAMIResourceId": { + "value": "[[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), concat('/subscriptions/', parameters('ALZManagementSubscriptionId'), '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('ALZUserAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" + }, + "severity": { + "value": "[[[parameters('HybridVMDataDiskWriteLatencyAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('HybridVMDataDiskWriteLatencyWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('HybridVMDataDiskWriteLatencyEvaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[[parameters('HybridVMDataDiskWriteLatencyAutoMitigate')]" + }, + "autoResolve": { + "value": "[[[parameters('HybridVMDataDiskWriteLatencyAutoResolve')]" + }, + "autoResolveTime": { + "value": "[[[parameters('HybridVMDataDiskWriteLatencyAutoResolveTime')]" + }, + "effect": { + "value": "[[[parameters('HybridVMDataDiskWriteLatencyPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('HybridVMDataDiskWriteLatencyAlertState')]" + }, + "threshold": { + "value": "[[[parameters('HybridVMDataDiskWriteLatencyThreshold')]" + }, + "operator": { + "value": "[[[parameters('HybridVMDataDiskWriteLatencyOperator')]" + }, + "timeAggregation": { + "value": "[[[parameters('HybridVMDataDiskWriteLatencyTimeAggregation')]" + }, + "failingPeriods": { + "value": "[[[parameters('HybridVMDataDiskWriteLatencyFailingPeriods')]" + }, + "evaluationPeriods": { + "value": "[[[parameters('HybridVMDataDiskWriteLatencyEvaluationPeriods')]" + }, + "computersToInclude": { + "value": "[[[parameters('HybridVMDataDiskWriteLatencyComputersToInclude')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_HybridVMDisconnected", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_Hybrid_VM_Disconnected_Alert", + "parameters": { + "UAMIResourceId": { + "value": "[[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), concat('/subscriptions/', parameters('ALZManagementSubscriptionId'), '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('ALZUserAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" + }, + "severity": { + "value": "[[[parameters('HybridVMDisconnectedAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('HybridVMDisconnectedAlertWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('HybridVMDisconnectedAlertEvaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[[parameters('HybridVMDisconnectedAlertAutoMitigate')]" + }, + "effect": { + "value": "[[[parameters('HybridVMDisconnectedAlertPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('HybridVMDisconnectedAlertState')]" + }, + "threshold": { + "value": "[[[parameters('HybridVMDisconnectedAlertThreshold')]" + }, + "operator": { + "value": "[[[parameters('HybridVMDisconnectedAlertOperator')]" + }, + "timeAggregation": { + "value": "[[[parameters('HybridVMDisconnectedAlertTimeAggregation')]" + }, + "failingPeriods": { + "value": "[[[parameters('HybridVMDisconnectedAlertFailingPeriods')]" + }, + "evaluationPeriods": { + "value": "[[[parameters('HybridVMDisconnectedAlertEvaluationPeriods')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + } + ], + "policyType": "Custom", + "policyDefinitionGroups": null + } + }, + "$fxv#2": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Hybrid_VM_dataDiskWriteLatency_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Hybrid VM Data Disk Write Latency Alert\",\n \"description\": \"Policy to audit/deploy VM dataDiskWriteLatency Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Hybrid Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"30\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.HybridCompute/machines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighDataDiskWriteLatencyAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteLatencyMs-Data-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteLatencyMs-Data-threshold-override_\\\", tostring(tags.[\\\"_amba-WriteLatencyMs-Data-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HybridVMdataDiskWriteLatencyAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighDataDiskWriteLatencyAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighDataDiskWriteLatencyAlert')]\",\n \"description\": \"Log Alert for Virtual Machine dataDiskWriteLatency\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.HybridCompute/machines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteLatencyMs-Data-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk !in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteLatencyMs-Data-threshold-override_\\\", tostring(tags.[\\\"_amba-WriteLatencyMs-Data-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"Disk\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#3": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Hybrid_VM_HeartBeat_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Hybrid VM HeartBeat Alert\",\n \"description\": \"Policy to audit/deploy VM HeartBeat Alert for all VMs in the subscription\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Hybrid Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"1\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT6H\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"10\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.HybridCompute/machines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHeartBeatAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-Heartbeat-threshold-override_\\\"); Heartbeat | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | summarize TimeGenerated=max(TimeGenerated) by Computer, _ResourceId | extend Duration = datetime_diff(\\\"minute\\\",now(),TimeGenerated) | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-Heartbeat-threshold-override_\\\", tostring(tags.[\\\"_amba-Heartbeat-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where Duration > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Duration', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HybridVMHeartBeatAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHeartBeatAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHeartBeatAlert')]\",\n \"description\": \"Log Alert for Virtual Machine Heartbeat\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.HybridCompute/machines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-Heartbeat-threshold-override_\\\"); Heartbeat | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | summarize TimeGenerated=max(TimeGenerated) by Computer, _ResourceId | extend Duration = datetime_diff(\\\"minute\\\",now(),TimeGenerated) | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-Heartbeat-threshold-override_\\\", tostring(tags.[\\\"_amba-Heartbeat-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where Duration > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Duration', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#4": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Hybrid_VM_NetworkIn_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Hybrid VM Network Read Alert\",\n \"description\": \"Policy to audit/deploy VM Nework Read Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Hybrid Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"10000000\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.HybridCompute/machines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighNetworkInAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadBytesPerSecond-Data-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Network\\\" and Name == \\\"ReadBytesPerSecond\\\" | extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadBytesPerSecond-Data-threshold-override_\\\", tostring(tags.[\\\"_amba-ReadBytesPerSecond-Data-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HybridVMVMNetworkInAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighNetworkInAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighNetworkInAlert')]\",\n \"description\": \"Log Alert for Virtual Machine NetworkIn\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.HybridCompute/machines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadBytesPerSecond-Data-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Network\\\" and Name == \\\"ReadBytesPerSecond\\\" | extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadBytesPerSecond-Data-threshold-override_\\\", tostring(tags.[\\\"_amba-ReadBytesPerSecond-Data-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"NetworkInterface\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#5": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Hybrid_VM_NetworkOut_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Hybrid VM Network Write Alert\",\n \"description\": \"Policy to audit/deploy VM Network Out Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Hybrid Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"10000000\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.HybridCompute/machines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighNetworkOutAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteBytesPerSecond-Data-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Network\\\" and Name == \\\"WriteBytesPerSecond\\\" | extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteBytesPerSecond-Data-threshold-override_\\\", tostring(tags.[\\\"_amba-WriteBytesPerSecond-Data-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HybridVMVMNetworkOutAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighNetworkOutAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighNetworkOutAlert')]\",\n \"description\": \"Log Alert for Virtual Machine NetworkOut\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.HybridCompute/machines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteBytesPerSecond-Data-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Network\\\" and Name == \\\"WriteBytesPerSecond\\\" | extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteBytesPerSecond-Data-threshold-override_\\\", tostring(tags.[\\\"_amba-WriteBytesPerSecond-Data-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"NetworkInterface\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#6": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Hybrid_VM_OSDiskreadLatency_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Hybrid VM OS Disk Read Latency Alert\",\n \"description\": \"Policy to audit/deploy VM OSDiskreadLatency Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Hybrid Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"30\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.HybridCompute/machines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighOSDiskReadLatencyAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadLatencyMs-OS-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadLatencyMs-OS-threshold-override_\\\", tostring(tags.[\\\"_amba-ReadLatencyMs-OS-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HybridVMOSDiskreadLatencyAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighOSDiskReadLatencyAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighOSDiskReadLatencyAlert')]\",\n \"description\": \"Log Alert for Virtual Machine OSDiskreadLatency\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.HybridCompute/machines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-ReadLatencyMs-OS-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-ReadLatencyMs-OS-threshold-override_\\\", tostring(tags.[\\\"_amba-ReadLatencyMs-OS-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"Disk\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#7": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Hybrid_VM_OSDiskSpace_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Hybrid VM OS Disk Space Alert\",\n \"description\": \"Policy to audit/deploy VM OSDiskSpace Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Hybrid Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"10\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.HybridCompute/machines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMLowOSDiskSpaceAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-FreeSpacePercentage-OS-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-FreeSpacePercentage-OS-threshold-override_\\\", tostring(tags.[\\\"_amba-FreeSpacePercentage-OS-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HybridVMOSDiskSpaceAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-HybridVMLowOSDiskSpaceAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMLowOSDiskSpaceAlert')]\",\n \"description\": \"Log Alert for Virtual Machine OSDiskSpace\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.HybridCompute/machines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-FreeSpacePercentage-OS-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-FreeSpacePercentage-OS-threshold-override_\\\", tostring(tags.[\\\"_amba-FreeSpacePercentage-OS-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"Disk\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#8": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Hybrid_VM_OSDiskwriteLatency_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Hybrid VM OS Disk Write Latency Alert\",\n \"description\": \"Policy to audit/deploy VM OSDiskwriteLatency Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Hybrid Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"30\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"computersToInclude\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Computers to be included to be monitored\",\n \"description\": \"Array of Computer to be monitored\"\n },\n \"defaultValue\": [\n \"*\"\n ]\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.HybridCompute/machines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighOSDiskWriteLatencyAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteLatencyMs-OS-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteLatencyMs-OS-threshold-override_\\\", tostring(tags.[\\\"_amba-WriteLatencyMs-OS-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"computersToInclude\": {\n \"type\": \"array\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HybridVMOSDiskwriteLatencyAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighOSDiskWriteLatencyAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighOSDiskWriteLatencyAlert')]\",\n \"description\": \"Log Alert for Virtual Machine OSDiskwriteLatency\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.HybridCompute/machines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-WriteLatencyMs-OS-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\" | extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"]) | where Disk in (\\\"C:\\\",\\\"/\\\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-WriteLatencyMs-OS-threshold-override_\\\", tostring(tags.[\\\"_amba-WriteLatencyMs-OS-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": \"[[parameters('computersToInclude')]\"\n },\n {\n \"name\": \"Disk\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"computersToInclude\": {\n \"value\": \"[[parameters('computersToInclude')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#9": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Hybrid_VM_CPU_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Hybrid VM CPU Alert\",\n \"description\": \"Policy to audit/deploy VM CPU Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Hybrid Compute\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"PT24H\"\n ],\n \"defaultValue\": \"PT15M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolve\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Resolve\",\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\n },\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"85\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.HybridCompute/machines\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighCPUAlert')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[subscription().id]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-UtilizationPercentage-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Processor\\\" and Name == \\\"UtilizationPercentage\\\" | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-UtilizationPercentage-threshold-override_\\\", tostring(tags.[\\\"_amba-UtilizationPercentage-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"autoResolve\": {\n \"type\": \"String\"\n },\n \"autoResolveTime\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"HybridVMCPUAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighCPUAlert')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighCPUAlert')]\",\n \"description\": \"Log Alert for Virtual Machine CPU\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"targetResourceTypes\": [\n \"Microsoft.HybridCompute/machines\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let policyThresholdString = \\\"{2}\\\"; let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.HybridCompute/machines\\\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\")); let overridenResource = (arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | project _ResourceId = tolower(id), tags | where tags contains \\\"_amba-UtilizationPercentage-threshold-override_\\\"); InsightsMetrics | where _ResourceId has \\\"Microsoft.HybridCompute/machines\\\" | where _ResourceId !in~ (excludedResources) | where Origin == \\\"vm.azm.ms\\\" | where Namespace == \\\"Processor\\\" and Name == \\\"UtilizationPercentage\\\" | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \\\"_amba-UtilizationPercentage-threshold-override_\\\", tostring(tags.[\\\"_amba-UtilizationPercentage-threshold-override_\\\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'), parameters('threshold'))]\",\n \"threshold\": 0,\n \"operator\": \"[[parameters('operator')]\",\n \"resourceIdColumn\": \"_ResourceId\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"dimensions\": [\n {\n \"name\": \"Computer\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"ruleResolveConfiguration\": {\n \"autoResolved\": \"[[parameters('autoResolve')]\",\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"autoResolve\": {\n \"value\": \"[[parameters('autoResolve')]\"\n },\n \"autoResolveTime\": {\n \"value\": \"[[parameters('autoResolveTime')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "cloudEnv": "[environment().name]", + "defaultDeploymentLocationByCloudType": { + "AzureCloud": "northeurope", + "AzureChinaCloud": "chinaeast2", + "AzureUSGovernment": "usgovvirginia" + }, + "templateVars": { + "scope": "/providers/Microsoft.Management/managementGroups/contoso", + "defaultDeploymentLocation": "\"location\": \"northeurope\"", + "localizedDeploymentLocation": "[format('\"location\": \"{0}\"', variables('defaultDeploymentLocationByCloudType')[variables('cloudEnv')])]" + }, + "targetDeploymentLocationByCloudType": { + "AzureCloud": "[coalesce(parameters('location'), 'northeurope')]", + "AzureChinaCloud": "[coalesce(parameters('location'), 'chinaeast2')]", + "AzureUSGovernment": "[coalesce(parameters('location'), 'usgovvirginia')]" + }, + "deploymentLocation": "[format('\"location\": \"{0}\"', variables('targetDeploymentLocationByCloudType')[variables('cloudEnv')])]", + "loadPolicyDefinitions": { + "All": [ + "[variables('$fxv#0')]", + "[variables('$fxv#1')]", + "[variables('$fxv#2')]", + "[variables('$fxv#3')]", + "[variables('$fxv#4')]", + "[variables('$fxv#5')]", + "[variables('$fxv#6')]", + "[variables('$fxv#7')]", + "[variables('$fxv#8')]", + "[variables('$fxv#9')]", + "[variables('$fxv#10')]", + "[variables('$fxv#11')]" + ], + "AzureCloud": [], + "AzureChinaCloud": [], + "AzureUSGovernment": [] + }, + "loadPolicySetDefinitions": { + "All": [ + "[string(variables('$fxv#12'))]" + ], + "AzureCloud": [], + "AzureChinaCloud": [], + "AzureUSGovernment": [] + }, + "policyDefinitionsByCloudType": { + "All": "[variables('policyDefinitionsAll')]", + "AzureCloud": "[variables('policyDefinitionsAzureCloud')]", + "AzureChinaCloud": "[variables('policyDefinitionsAzureChinaCloud')]", + "AzureUSGovernment": "[variables('policyDefinitionsAzureUSGovernment')]" + }, + "policySetDefinitionsByCloudType": { + "All": "[variables('policySetDefinitionsAll')]", + "AzureCloud": "[variables('policySetDefinitionsAzureCloud')]", + "AzureChinaCloud": "[variables('policySetDefinitionsAzureChinaCloud')]", + "AzureUSGovernment": "[variables('policySetDefinitionsAzureUSGovernment')]" + }, + "policyDefinitions": "[concat(variables('policyDefinitionsByCloudType').All, variables('policyDefinitionsByCloudType')[variables('cloudEnv')])]", + "policySetDefinitions": "[concat(variables('policySetDefinitionsByCloudType').All, variables('policySetDefinitionsByCloudType')[variables('cloudEnv')])]" + }, + "resources": [ + { + "copy": { + "name": "PolicyDefinitions", + "count": "[length(variables('policyDefinitions'))]" + }, + "type": "Microsoft.Authorization/policyDefinitions", + "apiVersion": "2020-09-01", + "name": "[variables('policyDefinitions')[copyIndex()].name]", + "properties": { + "description": "[variables('policyDefinitions')[copyIndex()].properties.description]", + "displayName": "[variables('policyDefinitions')[copyIndex()].properties.displayName]", + "metadata": "[variables('policyDefinitions')[copyIndex()].properties.metadata]", + "mode": "[variables('policyDefinitions')[copyIndex()].properties.mode]", + "parameters": "[variables('policyDefinitions')[copyIndex()].properties.parameters]", + "policyType": "[variables('policyDefinitions')[copyIndex()].properties.policyType]", + "policyRule": "[variables('policyDefinitions')[copyIndex()].properties.policyRule]" + } + }, + { + "copy": { + "name": "PolicySetDefinitions", + "count": "[length(variables('policySetDefinitions'))]" + }, + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2020-09-01", + "name": "[variables('policySetDefinitions')[copyIndex()].name]", + "properties": { + "description": "[variables('policySetDefinitions')[copyIndex()].properties.description]", + "displayName": "[variables('policySetDefinitions')[copyIndex()].properties.displayName]", + "metadata": "[variables('policySetDefinitions')[copyIndex()].properties.metadata]", + "parameters": "[variables('policySetDefinitions')[copyIndex()].properties.parameters]", + "policyType": "[variables('policySetDefinitions')[copyIndex()].properties.policyType]", + "policyDefinitions": "[variables('policySetDefinitions')[copyIndex()].properties.policyDefinitions]", + "policyDefinitionGroups": "[variables('policySetDefinitions')[copyIndex()].properties.policyDefinitionGroups]" + }, + "dependsOn": [ + "PolicyDefinitions" + ] + } + ], + "outputs": { + "policyDefinitionNames": { + "type": "array", + "copy": { + "count": "[length(variables('policyDefinitions'))]", + "input": "[variables('policyDefinitions')[copyIndex()].name]" + } + }, + "policySetDefinitionNames": { + "type": "array", + "copy": { + "count": "[length(variables('policySetDefinitions'))]", + "input": "[variables('policySetDefinitions')[copyIndex()].name]" + } + } + } +} \ No newline at end of file diff --git a/patterns/alz/policyDefinitions/policies-KeyManagement.json b/patterns/alz/policyDefinitions/policies-KeyManagement.json new file mode 100644 index 000000000..0cd8b304f --- /dev/null +++ b/patterns/alz/policyDefinitions/policies-KeyManagement.json @@ -0,0 +1,1819 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-08-01/managementGroupDeploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.29.47.4906", + "templateHash": "5082594690509693311" + } + }, + "parameters": { + "topLevelManagementGroupPrefix": { + "type": "string", + "defaultValue": "alz", + "metadata": { + "message": "The JSON version of this file is programatically generated from Bicep. PLEASE DO NOT UPDATE MANUALLY!!", + "description": "Provide a prefix (unique at tenant-scope) for the Management Group hierarchy and other resources created as part of an Azure landing zone. DEFAULT VALUE = \"alz\"" + } + }, + "location": { + "type": "string", + "defaultValue": "[deployment().location]", + "metadata": { + "description": "Optionally set the deployment location for policies with Deploy If Not Exists effect. DEFAULT VALUE = \"deployment().location\"" + } + }, + "scope": { + "type": "string", + "defaultValue": "[tenantResourceId('Microsoft.Management/managementGroups', parameters('topLevelManagementGroupPrefix'))]", + "metadata": { + "description": "Optionally set the scope for custom Policy Definitions used in Policy Set Definitions (Initiatives). Must be one of '/', '/subscriptions/id' or '/providers/Microsoft.Management/managementGroups/id'. DEFAULT VALUE = '/providers/Microsoft.Management/managementGroups/${topLevelManagementGroupPrefix}'" + } + } + }, + "variables": { + "copy": [ + { + "name": "processPolicyDefinitionsAll", + "count": "[length(variables('loadPolicyDefinitions').All)]", + "input": "[replace(replace(variables('loadPolicyDefinitions').All[copyIndex('processPolicyDefinitionsAll')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" + }, + { + "name": "processPolicyDefinitionsAzureCloud", + "count": "[length(variables('loadPolicyDefinitions').AzureCloud)]", + "input": "[replace(replace(variables('loadPolicyDefinitions').AzureCloud[copyIndex('processPolicyDefinitionsAzureCloud')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" + }, + { + "name": "processPolicyDefinitionsAzureChinaCloud", + "count": "[length(variables('loadPolicyDefinitions').AzureChinaCloud)]", + "input": "[replace(replace(variables('loadPolicyDefinitions').AzureChinaCloud[copyIndex('processPolicyDefinitionsAzureChinaCloud')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" + }, + { + "name": "processPolicyDefinitionsAzureUSGovernment", + "count": "[length(variables('loadPolicyDefinitions').AzureUSGovernment)]", + "input": "[replace(replace(variables('loadPolicyDefinitions').AzureUSGovernment[copyIndex('processPolicyDefinitionsAzureUSGovernment')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" + }, + { + "name": "processPolicySetDefinitionsAll", + "count": "[length(variables('loadPolicySetDefinitions').All)]", + "input": "[replace(variables('loadPolicySetDefinitions').All[copyIndex('processPolicySetDefinitionsAll')], variables('templateVars').scope, parameters('scope'))]" + }, + { + "name": "processPolicySetDefinitionsAzureCloud", + "count": "[length(variables('loadPolicySetDefinitions').AzureCloud)]", + "input": "[replace(variables('loadPolicySetDefinitions').AzureCloud[copyIndex('processPolicySetDefinitionsAzureCloud')], variables('templateVars').scope, parameters('scope'))]" + }, + { + "name": "processPolicySetDefinitionsAzureChinaCloud", + "count": "[length(variables('loadPolicySetDefinitions').AzureChinaCloud)]", + "input": "[replace(variables('loadPolicySetDefinitions').AzureChinaCloud[copyIndex('processPolicySetDefinitionsAzureChinaCloud')], variables('templateVars').scope, parameters('scope'))]" + }, + { + "name": "processPolicySetDefinitionsAzureUSGovernment", + "count": "[length(variables('loadPolicySetDefinitions').AzureUSGovernment)]", + "input": "[replace(variables('loadPolicySetDefinitions').AzureUSGovernment[copyIndex('processPolicySetDefinitionsAzureUSGovernment')], variables('templateVars').scope, parameters('scope'))]" + }, + { + "name": "policyDefinitionsAll", + "count": "[length(variables('processPolicyDefinitionsAll'))]", + "input": "[json(variables('processPolicyDefinitionsAll')[copyIndex('policyDefinitionsAll')])]" + }, + { + "name": "policyDefinitionsAzureCloud", + "count": "[length(variables('processPolicyDefinitionsAzureCloud'))]", + "input": "[json(variables('processPolicyDefinitionsAzureCloud')[copyIndex('policyDefinitionsAzureCloud')])]" + }, + { + "name": "policyDefinitionsAzureChinaCloud", + "count": "[length(variables('processPolicyDefinitionsAzureChinaCloud'))]", + "input": "[json(variables('processPolicyDefinitionsAzureChinaCloud')[copyIndex('policyDefinitionsAzureChinaCloud')])]" + }, + { + "name": "policyDefinitionsAzureUSGovernment", + "count": "[length(variables('processPolicyDefinitionsAzureUSGovernment'))]", + "input": "[json(variables('processPolicyDefinitionsAzureUSGovernment')[copyIndex('policyDefinitionsAzureUSGovernment')])]" + }, + { + "name": "policySetDefinitionsAll", + "count": "[length(variables('processPolicySetDefinitionsAll'))]", + "input": "[json(variables('processPolicySetDefinitionsAll')[copyIndex('policySetDefinitionsAll')])]" + }, + { + "name": "policySetDefinitionsAzureCloud", + "count": "[length(variables('processPolicySetDefinitionsAzureCloud'))]", + "input": "[json(variables('processPolicySetDefinitionsAzureCloud')[copyIndex('policySetDefinitionsAzureCloud')])]" + }, + { + "name": "policySetDefinitionsAzureChinaCloud", + "count": "[length(variables('processPolicySetDefinitionsAzureChinaCloud'))]", + "input": "[json(variables('processPolicySetDefinitionsAzureChinaCloud')[copyIndex('policySetDefinitionsAzureChinaCloud')])]" + }, + { + "name": "policySetDefinitionsAzureUSGovernment", + "count": "[length(variables('processPolicySetDefinitionsAzureUSGovernment'))]", + "input": "[json(variables('processPolicySetDefinitionsAzureUSGovernment')[copyIndex('policySetDefinitionsAzureUSGovernment')])]" + } + ], + "$fxv#0": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_KeyVault_Availability_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Key Vault Availability Alert\",\n \"description\": \"Policy to audit/deploy KeyVault Availability Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Key Vault\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"1\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT1M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"90\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"disabled\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"microsoft.keyvault/vaults\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"microsoft.keyvault/vaults\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"Availability\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/microsoft.keyvault/vaults/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\n \"equals\": \"LessThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-Availability-threshold-Override_'), field('tags._amba-Availability-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-Availability')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for KeyVault Availability\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"Availability\",\n \"metricNamespace\": \"microsoft.keyvault/vaults\",\n \"metricName\": \"Availability\",\n \"operator\": \"LessThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-Availability-threshold-Override_'), field('tags._amba-Availability-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#1": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_KeyVault_Capacity_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Key Vault Capacity Alert\",\n \"description\": \"Policy to audit/deploy KeyVault Capacity Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Key Vault\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"1\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT1M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"75\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"disabled\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"microsoft.keyvault/vaults\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"microsoft.keyvault/vaults\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"SaturationShoebox\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/microsoft.keyvault/vaults/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\n \"equals\": \"GreaterThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-SaturationShoebox-threshold-Override_'), field('tags._amba-SaturationShoebox-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-CapacityAlert')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for KeyVault Capacity\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"SaturationShoebox\",\n \"metricNamespace\": \"microsoft.keyvault/vaults\",\n \"metricName\": \"SaturationShoebox\",\n \"operator\": \"GreaterThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-SaturationShoebox-threshold-Override_'), field('tags._amba-SaturationShoebox-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#2": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_KeyVault_Latency_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Key Vault Latency Alert\",\n \"description\": \"Policy to audit/deploy KeyVault Latency Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Key Vault\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"3\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"1000\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"disabled\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"microsoft.keyvault/vaults\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"microsoft.keyvault/vaults\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"ServiceApiLatency\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/microsoft.keyvault/vaults/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\n \"equals\": \"GreaterThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-ServiceApiLatency-threshold-Override_'), field('tags._amba-ServiceApiLatency-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-LatencyAlert')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for KeyVault Latency\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"ServiceApiLatency\",\n \"metricNamespace\": \"microsoft.keyvault/vaults\",\n \"metricName\": \"ServiceApiLatency\",\n \"operator\": \"GreaterThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-ServiceApiLatency-threshold-Override_'), field('tags._amba-ServiceApiLatency-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#3": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_KeyVault_Requests_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Key Vault Requests Alert\",\n \"description\": \"Policy to audit/deploy KeyVault Requests Alert\",\n \"metadata\": {\n \"version\": \"1.3.0\",\n \"category\": \"Key Vault\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"disabled\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"microsoft.keyvault/vaults\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"microsoft.keyvault/vaults\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"ServiceApiResult\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/microsoft.keyvault/vaults/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\n \"equals\": \"GreaterThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\n \"equals\": \"Medium\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": 4\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": 4\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-RequestsAlert')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for KeyVault Requests\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"alertSensitivity\": \"Medium\",\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": 4,\n \"minFailingPeriodsToAlert\": 4\n },\n \"name\": \"ServiceApiResult\",\n \"metricNamespace\": \"microsoft.keyvault/vaults\",\n \"metricName\": \"ServiceApiResult\",\n \"operator\": \"GreaterThan\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"DynamicThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#4": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_activitylog_KeyVault_Delete\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Activity Log Key Vault Delete Alert\",\n \"description\": \"Policy to Deploy Activity Log Key Vault Delete Alert\",\n \"metadata\": {\n \"version\": \"1.1.0\",\n \"category\": \"Key Vault\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"_deployed_by_amba\": true\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"microsoft.keyvault/vaults\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/activityLogAlerts\",\n \"name\": \"ActivityKeyVaultDelete\",\n \"existenceScope\": \"resourcegroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"count\": {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*]\",\n \"where\": {\n \"anyOf\": [\n {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].field\",\n \"equals\": \"category\"\n },\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].equals\",\n \"equals\": \"Administrative\"\n }\n ]\n },\n {\n \"allOf\": [\n {\n \"field\": \"microsoft.insights/activityLogAlerts/condition.allOf[*].field\",\n \"equals\": \"operationName\"\n },\n {\n \"field\": \"microsoft.insights/activityLogAlerts/condition.allOf[*].equals\",\n \"equals\": \"Microsoft.KeyVault/vaults/delete\"\n }\n ]\n }\n ]\n }\n },\n \"equals\": 2\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"enabled\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"ActivityKeyVaultDelete\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"microsoft.insights/activityLogAlerts\",\n \"apiVersion\": \"2020-10-01\",\n \"name\": \"ActivityKeyVaultDelete\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Activity Log Key Vault Delete\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().id]\"\n ],\n \"condition\": {\n \"allOf\": [\n {\n \"field\": \"category\",\n \"equals\": \"Administrative\"\n },\n {\n \"field\": \"operationName\",\n \"equals\": \"Microsoft.KeyVault/vaults/delete\"\n },\n {\n \"field\": \"status\",\n \"containsAny\": [\n \"succeeded\"\n ]\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#5": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_ActivityLog_ManagedHSMs_Delete\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Activity Log Managed HSMs Delete Alert\",\n \"description\": \"Policy to Deploy Activity Log Managed HSMs Delete Alert\",\n \"metadata\": {\n \"version\": \"1.0.0\",\n \"category\": \"Key Vault\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"_deployed_by_amba\": true\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"microsoft.keyvault/managedHSMs\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/activityLogAlerts\",\n \"name\": \"ActivityManagedHSMDelete\",\n \"existenceScope\": \"resourcegroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"count\": {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*]\",\n \"where\": {\n \"anyOf\": [\n {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].field\",\n \"equals\": \"category\"\n },\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].equals\",\n \"equals\": \"Administrative\"\n }\n ]\n },\n {\n \"allOf\": [\n {\n \"field\": \"microsoft.insights/activityLogAlerts/condition.allOf[*].field\",\n \"equals\": \"operationName\"\n },\n {\n \"field\": \"microsoft.insights/activityLogAlerts/condition.allOf[*].equals\",\n \"equals\": \"Microsoft.KeyVault/ManagedHSMs/delete\"\n }\n ]\n }\n ]\n }\n },\n \"equals\": 2\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"enabled\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"ActivityManagedHSMDelete\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"microsoft.insights/activityLogAlerts\",\n \"apiVersion\": \"2020-10-01\",\n \"name\": \"ActivityManagedHSMDelete\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Activity Log Managed HSM Delete\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().id]\"\n ],\n \"condition\": {\n \"allOf\": [\n {\n \"field\": \"category\",\n \"equals\": \"Administrative\"\n },\n {\n \"field\": \"operationName\",\n \"equals\": \"Microsoft.KeyVault/managedHSMs/delete\"\n },\n {\n \"field\": \"status\",\n \"containsAny\": [\n \"succeeded\"\n ]\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#6": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_ManagedHSMs_Availability_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Managed HSMs Availability Alert\",\n \"description\": \"Policy to audit/deploy Managed HSMs Availability Alert\",\n \"metadata\": {\n \"version\": \"1.0.0\",\n \"category\": \"Key Vault\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"1\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT1M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"90\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"disabled\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"microsoft.keyvault/managedHSMs\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.KeyVault/ManagedHSMs\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"Availability\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/microsoft.keyvault/managedHSMs/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\n \"equals\": \"LessThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-Availability-threshold-Override_'), field('tags._amba-Availability-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-Availability')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for ManagedHSM Availability\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"Availability\",\n \"metricNamespace\": \"microsoft.keyvault/managedHSMs\",\n \"metricName\": \"Availability\",\n \"operator\": \"LessThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-Availability-threshold-Override_'), field('tags._amba-Availability-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#7": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_ManagedHSMs_Latency_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Managed HSMs Latency Alert\",\n \"description\": \"Policy to audit/deploy Managed HSMs Latency Alert\",\n \"metadata\": {\n \"version\": \"1.1.0\",\n \"category\": \"Key Vault\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"3\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"1000\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"disabled\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"microsoft.keyvault/managedHSMs\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.KeyVault/managedHSMs\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"ServiceApiLatency\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/microsoft.keyvault/managedHSMs', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\n \"equals\": \"GreaterThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-ServiceApiLatency-threshold-Override_'), field('tags._amba-ServiceApiLatency-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-LatencyAlert')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for ManagedHSM Latency\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"ServiceApiLatency\",\n \"metricNamespace\": \"Microsoft.KeyVault/managedHSMs\",\n \"metricName\": \"ServiceApiLatency\",\n \"operator\": \"GreaterThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-ServiceApiLatency-threshold-Override_'), field('tags._amba-ServiceApiLatency-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#8": { + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "name": "Alerting-KeyManagement", + "properties": { + "displayName": "Deploy Azure Monitor Baseline Alerts for Key Management", + "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Key Management Services such as Azure Key Vault, and Managed HSM.", + "metadata": { + "version": "1.0.0", + "category": "Monitoring", + "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", + "alzCloudEnvironments": [ + "AzureCloud" + ], + "_deployed_by_amba": true + }, + "parameters": { + "ALZMonitorResourceGroupName": { + "type": "String", + "defaultValue": "ALZ-Monitoring-RG", + "metadata": { + "displayName": "ALZ Monitor Resource Group Name", + "description": "Name of the resource group where the ALZ Monitor resources will be deployed" + } + }, + "ALZMonitorResourceGroupTags": { + "type": "Object", + "defaultValue": { + "_deployed_by_amba": true + }, + "metadata": { + "displayName": "ALZ Monitor Resource Group Tags", + "description": "Tags for the resource group where the ALZ Monitor resources will be deployed" + } + }, + "ALZMonitorResourceGroupLocation": { + "type": "String", + "defaultValue": "centralus", + "metadata": { + "displayName": "ALZ Monitor Resource Group Location", + "description": "Location of the resource group where the ALZ Monitor resources will be deployed" + } + }, + "ALZMonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": "MonitorDisable" + }, + "ALZMonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] + }, + "KVRequestAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "Key Vault Request Alert Severity", + "description": "Severity of the alert for Key Vault Request" + } + }, + "KVRequestWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "Key Vault Request Window Size", + "description": "Window size for the alert" + } + }, + "KVRequestEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "Key Vault Request Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "KVRequestPolicyEffect": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Key Vault Request Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "KVRequestAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Key Vault Request Alert State", + "description": "Alert state for the alert" + } + }, + "KvAvailabilityAlertSeverity": { + "type": "String", + "defaultValue": "1", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "Key Vault Availability Alert Severity", + "description": "Severity of the alert for Key Vault Availability" + } + }, + "KvAvailabilityWindowSize": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "Key Vault Availability Window Size", + "description": "Window size for the alert" + } + }, + "KvAvailabilityEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "Key Vault Availability Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "KvAvailabilityPolicyEffect": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Key Vault Availability Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "KvAvailabilityAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Key Vault Availability Alert State", + "description": "Alert state for the alert" + } + }, + "KVAvailabilityThreshold": { + "type": "string", + "defaultValue": "20", + "metadata": { + "displayName": "Key Vault Availability Threshold", + "description": "Threshold for the alert" + } + }, + "KvLatencyAvailabilityAlertSeverity": { + "type": "String", + "defaultValue": "3", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "Key Vault Latency Availability Alert Severity", + "description": "Severity of the alert for Key Vault Latency Availability" + } + }, + "KvLatencyAvailabilityWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "Key Vault Latency Availability Window Size", + "description": "Window size for the alert" + } + }, + "KvLatencyAvailabilityEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "Key Vault Latency Availability Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "KvLatencyAvailabilityPolicyEffect": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Key Vault Latency Availability Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "KvLatencyAvailabilityAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Key Vault Latency Availability Alert State", + "description": "Alert state for the alert" + } + }, + "KvLatencyAvailabilityThreshold": { + "type": "string", + "defaultValue": "1000", + "metadata": { + "displayName": "Key Vault Latency Availability Threshold", + "description": "Threshold for the alert" + } + }, + "KVCapacityAlertSeverity": { + "type": "String", + "defaultValue": "1", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "Key Vault Capacity Alert Severity", + "description": "Severity of the alert for Key Vault Capacity" + } + }, + "KVCapacityWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "Key Vault Capacity Window Size", + "description": "Window size for the alert" + } + }, + "KVCapacityEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "Key Vault Capacity Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "KVCapacityPolicyEffect": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Key Vault Capacity Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "KVCapacityAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Key Vault Capacity Alert State", + "description": "Alert state for the alert" + } + }, + "KVCapacityThreshold": { + "type": "string", + "defaultValue": "75", + "metadata": { + "displayName": "Key Vault Capacity Threshold", + "description": "Threshold for the alert" + } + }, + "activityKVDeleteAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Activity Key Vault Delete Alert State", + "description": "Alert state for the alert" + } + }, + "activityKVDeletePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Key Vault Delete Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "HSMsAvailabilityAlertSeverity": { + "type": "String", + "defaultValue": "1", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "Key Vault Managed HSMs Availability Alert Severity", + "description": "Severity of the alert for Key Vault Managed HSMs Availability" + } + }, + "HSMsAvailabilityWindowSize": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "Key Vault Managed HSMs Availability Window Size", + "description": "Window size for the alert" + } + }, + "HSMsAvailabilityEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "Key Vault Managed HSMs Availability Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "HSMsAvailabilityPolicyEffect": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Key Vault Managed HSMs Availability Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "HSMsAvailabilityAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Key Vault Managed HSMs Availability Alert State", + "description": "Alert state for the alert" + } + }, + "HSMsAvailabilityThreshold": { + "type": "string", + "defaultValue": "20", + "metadata": { + "displayName": "Key Vault Managed HSMs Availability Threshold", + "description": "Threshold for the alert" + } + }, + "HSMsLatencyAvailabilityAlertSeverity": { + "type": "String", + "defaultValue": "3", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "Key Vault Managed HSMs Latency Availability Alert Severity", + "description": "Severity of the alert for Key Vault Managed HSMs Latency Availability" + } + }, + "HSMsLatencyAvailabilityWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "Key Vault Managed HSMs Latency Availability Window Size", + "description": "Window size for the alert" + } + }, + "HSMsLatencyAvailabilityEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "Key Vault Managed HSMs Latency Availability Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "HSMsLatencyAvailabilityPolicyEffect": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Key Vault Managed HSMs Latency Availability Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "HSMsLatencyAvailabilityAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Key Vault Managed HSMs Latency Availability Alert State", + "description": "Alert state for the alert" + } + }, + "HSMsLatencyAvailabilityThreshold": { + "type": "string", + "defaultValue": "1000", + "metadata": { + "displayName": "Key Vault Managed HSMs Latency Availability Threshold", + "description": "Threshold for the alert" + } + }, + "activityHSMsDeleteAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Activity Key Vault Managed HSMs Delete Alert State", + "description": "Alert state for the alert" + } + }, + "activityHSMsDeletePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Key Vault Managed HSMs Delete Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "ALZ_KVRequest", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_KeyVault_Requests_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('KVRequestAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('KVRequestWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('KVRequestEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('KVRequestPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('KVRequestAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_KvAvailability", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_KeyVault_Availability_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('KvAvailabilityAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('KvAvailabilityWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('KvAvailabilityEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('KvAvailabilityPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('KvAvailabilityAlertState')]" + }, + "threshold": { + "value": "[[[parameters('KVAvailabilityThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_KvLatencyAvailability", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_KeyVault_Latency_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('KvLatencyAvailabilityAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('KvLatencyAvailabilityWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('KvLatencyAvailabilityEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('KvLatencyAvailabilityPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('KvLatencyAvailabilityAlertState')]" + }, + "threshold": { + "value": "[[[parameters('KvLatencyAvailabilityThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_KVCapacity", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_KeyVault_Capacity_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('KVCapacityAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('KVCapacityWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('KVCapacityEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('KVCapacityPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('KVCapacityAlertState')]" + }, + "threshold": { + "value": "[[[parameters('KVCapacityThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_activityKVDelete", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_KeyVault_Delete", + "parameters": { + "enabled": { + "value": "[[[parameters('activityKVDeleteAlertState')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "effect": { + "value": "[[[parameters('activityKVDeletePolicyEffect')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_ManagedHSMsAvailability", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ManagedHSMs_Availability_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('HSMsAvailabilityAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('HSMsAvailabilityWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('HSMsAvailabilityEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('HSMsAvailabilityPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('HSMsAvailabilityAlertState')]" + }, + "threshold": { + "value": "[[[parameters('HSMsAvailabilityThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_ManagedHSMsLatencyAvailability", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ManagedHSMs_Latency_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('HSMsLatencyAvailabilityAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('HSMsLatencyAvailabilityWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('HSMsLatencyAvailabilityEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('HSMsLatencyAvailabilityPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('HSMsLatencyAvailabilityAlertState')]" + }, + "threshold": { + "value": "[[[parameters('HSMsLatencyAvailabilityThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_activityManagedHSMsDelete", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ActivityLog_ManagedHSMs_Delete", + "parameters": { + "enabled": { + "value": "[[[parameters('activityHSMsDeleteAlertState')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "effect": { + "value": "[[[parameters('activityHSMsDeletePolicyEffect')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + } + ], + "policyType": "Custom", + "policyDefinitionGroups": null + } + }, + "$fxv#9": { + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "name": "Alerting-Identity", + "properties": { + "displayName": "Deploy Azure Monitor Baseline Alerts for Identity", + "description": "Initiative to deploy AMBA alerts relevant to the ALZ Identity management group", + "metadata": { + "version": "1.1.0", + "category": "Monitoring", + "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", + "alzCloudEnvironments": [ + "AzureCloud" + ], + "_deployed_by_amba": true + }, + "parameters": { + "ALZMonitorResourceGroupName": { + "type": "String", + "defaultValue": "ALZ-Monitoring-RG", + "metadata": { + "displayName": "ALZ Monitor Resource Group Name", + "description": "Name of the resource group where the alerting resources will be deployed" + } + }, + "ALZMonitorResourceGroupTags": { + "type": "Object", + "defaultValue": { + "_deployed_by_alz_monitor": true + }, + "metadata": { + "displayName": "ALZ Monitor Resource Group Tags", + "description": "Tags for the resource group where the alerting resources will be deployed" + } + }, + "ALZMonitorResourceGroupLocation": { + "type": "String", + "defaultValue": "centralus", + "metadata": { + "displayName": "ALZ Monitor Resource Group Location", + "description": "Location of the resource group where the alerting resources will be deployed" + } + }, + "ALZMonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": "MonitorDisable" + }, + "ALZMonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] + }, + "KVRequestAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "KeyVault Request Alert Severity", + "description": "Severity of the alert" + } + }, + "KVRequestWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "KeyVault Request Alert Window Size", + "description": "Window size for the alert" + } + }, + "KVRequestEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "KeyVault Request Alert Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "KVRequestPolicyEffect": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "KeyVault Request Alert Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "KVRequestAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "KeyVault Request Alert State", + "description": "State of the alert, true will enable the alert, false will disable the alert" + } + }, + "KvAvailabilityAlertSeverity": { + "type": "String", + "defaultValue": "1", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "KeyVault Availability Alert Severity", + "description": "Severity of the alert" + } + }, + "KvAvailabilityWindowSize": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "KeyVault Availability Alert Window Size", + "description": "Window size for the alert" + } + }, + "KvAvailabilityEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "KeyVault Availability Alert Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "KvAvailabilityPolicyEffect": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "KeyVault Availability Alert Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "KvAvailabilityAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "KeyVault Availability Alert State", + "description": "State of the alert, true will enable the alert, false will disable the alert" + } + }, + "KVAvailabilityThreshold": { + "type": "string", + "defaultValue": "20", + "metadata": { + "displayName": "KeyVault Availability Alert Threshold", + "description": "Threshold for the alert" + } + }, + "KvLatencyAvailabilityAlertSeverity": { + "type": "String", + "defaultValue": "3", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "KeyVault Latency Alert Severity", + "description": "Severity of the alert" + } + }, + "KvLatencyAvailabilityWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "KeyVault Latency Alert Window Size", + "description": "Window size for the alert" + } + }, + "KvLatencyAvailabilityEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "KeyVault Latency Alert Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "KvLatencyAvailabilityPolicyEffect": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "KeyVault Latency Alert Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "KvLatencyAvailabilityAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "KeyVault Latency Alert State", + "description": "State of the alert, true will enable the alert, false will disable the alert" + } + }, + "KvLatencyAvailabilityThreshold": { + "type": "string", + "defaultValue": "1000", + "metadata": { + "displayName": "KeyVault Latency Alert Threshold", + "description": "Threshold for the alert" + } + }, + "KVCapacityAlertSeverity": { + "type": "String", + "defaultValue": "1", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "KeyVault Capacity Alert Severity", + "description": "Severity of the alert" + } + }, + "KVCapacityWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "KeyVault Capacity Alert Window Size", + "description": "Window size for the alert" + } + }, + "KVCapacityEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "KeyVault Capacity Alert Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "KVCapacityPolicyEffect": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "KeyVault Capacity Alert Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "KVCapacityAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "KeyVault Capacity Alert State", + "description": "State of the alert, true will enable the alert, false will disable the alert" + } + }, + "KVCapacityThreshold": { + "type": "string", + "defaultValue": "75", + "metadata": { + "displayName": "KeyVault Capacity Alert Threshold", + "description": "Threshold for the alert" + } + }, + "activityKVDeleteAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Activity Log KeyVault Delete Alert State", + "description": "State of the alert, true will enable the alert, false will disable the alert" + } + }, + "activityKVDeletePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Key Vault Delete Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "HSMsAvailabilityAlertSeverity": { + "type": "String", + "defaultValue": "1", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "Key Vault Managed HSMs Availability Alert Severity", + "description": "Severity of the alert for Key Vault Managed HSMs Availability" + } + }, + "HSMsAvailabilityWindowSize": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "Key Vault Managed HSMs Availability Window Size", + "description": "Window size for the alert" + } + }, + "HSMsAvailabilityEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "Key Vault Managed HSMs Availability Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "HSMsAvailabilityPolicyEffect": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Key Vault Managed HSMs Availability Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "HSMsAvailabilityAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Key Vault Managed HSMs Availability Alert State", + "description": "Alert state for the alert" + } + }, + "HSMsAvailabilityThreshold": { + "type": "string", + "defaultValue": "20", + "metadata": { + "displayName": "Key Vault Managed HSMs Availability Threshold", + "description": "Threshold for the alert" + } + }, + "HSMsLatencyAvailabilityAlertSeverity": { + "type": "String", + "defaultValue": "3", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "Key Vault Managed HSMs Latency Availability Alert Severity", + "description": "Severity of the alert for Key Vault Managed HSMs Latency Availability" + } + }, + "HSMsLatencyAvailabilityWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "Key Vault Managed HSMs Latency Availability Window Size", + "description": "Window size for the alert" + } + }, + "HSMsLatencyAvailabilityEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "Key Vault Managed HSMs Latency Availability Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "HSMsLatencyAvailabilityPolicyEffect": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Key Vault Managed HSMs Latency Availability Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "HSMsLatencyAvailabilityAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Key Vault Managed HSMs Latency Availability Alert State", + "description": "Alert state for the alert" + } + }, + "HSMsLatencyAvailabilityThreshold": { + "type": "string", + "defaultValue": "1000", + "metadata": { + "displayName": "Key Vault Managed HSMs Latency Availability Threshold", + "description": "Threshold for the alert" + } + }, + "activityHSMsDeleteAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Activity Key Vault Managed HSMs Delete Alert State", + "description": "Alert state for the alert" + } + }, + "activityHSMsDeletePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Key Vault Managed HSMs Delete Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "ALZ_KVRequest", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_KeyVault_Requests_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('KVRequestAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('KVRequestWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('KVRequestEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('KVRequestPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('KVRequestAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_KvAvailability", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_KeyVault_Availability_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('KvAvailabilityAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('KvAvailabilityWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('KvAvailabilityEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('KvAvailabilityPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('KvAvailabilityAlertState')]" + }, + "threshold": { + "value": "[[[parameters('KVAvailabilityThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_KvLatencyAvailability", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_KeyVault_Latency_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('KvLatencyAvailabilityAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('KvLatencyAvailabilityWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('KvLatencyAvailabilityEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('KvLatencyAvailabilityPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('KvLatencyAvailabilityAlertState')]" + }, + "threshold": { + "value": "[[[parameters('KvLatencyAvailabilityThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_KVCapacity", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_KeyVault_Capacity_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('KVCapacityAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('KVCapacityWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('KVCapacityEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('KVCapacityPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('KVCapacityAlertState')]" + }, + "threshold": { + "value": "[[[parameters('KVCapacityThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_activityKVDelete", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_KeyVault_Delete", + "parameters": { + "effect": { + "value": "[[[parameters('activityKVDeletePolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('activityKVDeleteAlertState')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_ManagedHSMsAvailability", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ManagedHSMs_Availability_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('HSMsAvailabilityAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('HSMsAvailabilityWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('HSMsAvailabilityEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('HSMsAvailabilityPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('HSMsAvailabilityAlertState')]" + }, + "threshold": { + "value": "[[[parameters('HSMsAvailabilityThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_ManagedHSMsLatencyAvailability", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ManagedHSMs_Latency_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('HSMsLatencyAvailabilityAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('HSMsLatencyAvailabilityWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('HSMsLatencyAvailabilityEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('HSMsLatencyAvailabilityPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('HSMsLatencyAvailabilityAlertState')]" + }, + "threshold": { + "value": "[[[parameters('HSMsLatencyAvailabilityThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_activityManagedHSMsDelete", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ActivityLog_ManagedHSMs_Delete", + "parameters": { + "enabled": { + "value": "[[[parameters('activityHSMsDeleteAlertState')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "effect": { + "value": "[[[parameters('activityHSMsDeletePolicyEffect')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + } + ], + "policyType": "Custom", + "policyDefinitionGroups": null + } + }, + "cloudEnv": "[environment().name]", + "defaultDeploymentLocationByCloudType": { + "AzureCloud": "northeurope", + "AzureChinaCloud": "chinaeast2", + "AzureUSGovernment": "usgovvirginia" + }, + "templateVars": { + "scope": "/providers/Microsoft.Management/managementGroups/contoso", + "defaultDeploymentLocation": "\"location\": \"northeurope\"", + "localizedDeploymentLocation": "[format('\"location\": \"{0}\"', variables('defaultDeploymentLocationByCloudType')[variables('cloudEnv')])]" + }, + "targetDeploymentLocationByCloudType": { + "AzureCloud": "[coalesce(parameters('location'), 'northeurope')]", + "AzureChinaCloud": "[coalesce(parameters('location'), 'chinaeast2')]", + "AzureUSGovernment": "[coalesce(parameters('location'), 'usgovvirginia')]" + }, + "deploymentLocation": "[format('\"location\": \"{0}\"', variables('targetDeploymentLocationByCloudType')[variables('cloudEnv')])]", + "loadPolicyDefinitions": { + "All": [ + "[variables('$fxv#0')]", + "[variables('$fxv#1')]", + "[variables('$fxv#2')]", + "[variables('$fxv#3')]", + "[variables('$fxv#4')]", + "[variables('$fxv#5')]", + "[variables('$fxv#6')]", + "[variables('$fxv#7')]" + ], + "AzureCloud": [], + "AzureChinaCloud": [], + "AzureUSGovernment": [] + }, + "loadPolicySetDefinitions": { + "All": [ + "[string(variables('$fxv#8'))]", + "[string(variables('$fxv#9'))]" + ], + "AzureCloud": [], + "AzureChinaCloud": [], + "AzureUSGovernment": [] + }, + "policyDefinitionsByCloudType": { + "All": "[variables('policyDefinitionsAll')]", + "AzureCloud": "[variables('policyDefinitionsAzureCloud')]", + "AzureChinaCloud": "[variables('policyDefinitionsAzureChinaCloud')]", + "AzureUSGovernment": "[variables('policyDefinitionsAzureUSGovernment')]" + }, + "policySetDefinitionsByCloudType": { + "All": "[variables('policySetDefinitionsAll')]", + "AzureCloud": "[variables('policySetDefinitionsAzureCloud')]", + "AzureChinaCloud": "[variables('policySetDefinitionsAzureChinaCloud')]", + "AzureUSGovernment": "[variables('policySetDefinitionsAzureUSGovernment')]" + }, + "policyDefinitions": "[concat(variables('policyDefinitionsByCloudType').All, variables('policyDefinitionsByCloudType')[variables('cloudEnv')])]", + "policySetDefinitions": "[concat(variables('policySetDefinitionsByCloudType').All, variables('policySetDefinitionsByCloudType')[variables('cloudEnv')])]" + }, + "resources": [ + { + "copy": { + "name": "PolicyDefinitions", + "count": "[length(variables('policyDefinitions'))]" + }, + "type": "Microsoft.Authorization/policyDefinitions", + "apiVersion": "2020-09-01", + "name": "[variables('policyDefinitions')[copyIndex()].name]", + "properties": { + "description": "[variables('policyDefinitions')[copyIndex()].properties.description]", + "displayName": "[variables('policyDefinitions')[copyIndex()].properties.displayName]", + "metadata": "[variables('policyDefinitions')[copyIndex()].properties.metadata]", + "mode": "[variables('policyDefinitions')[copyIndex()].properties.mode]", + "parameters": "[variables('policyDefinitions')[copyIndex()].properties.parameters]", + "policyType": "[variables('policyDefinitions')[copyIndex()].properties.policyType]", + "policyRule": "[variables('policyDefinitions')[copyIndex()].properties.policyRule]" + } + }, + { + "copy": { + "name": "PolicySetDefinitions", + "count": "[length(variables('policySetDefinitions'))]" + }, + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2020-09-01", + "name": "[variables('policySetDefinitions')[copyIndex()].name]", + "properties": { + "description": "[variables('policySetDefinitions')[copyIndex()].properties.description]", + "displayName": "[variables('policySetDefinitions')[copyIndex()].properties.displayName]", + "metadata": "[variables('policySetDefinitions')[copyIndex()].properties.metadata]", + "parameters": "[variables('policySetDefinitions')[copyIndex()].properties.parameters]", + "policyType": "[variables('policySetDefinitions')[copyIndex()].properties.policyType]", + "policyDefinitions": "[variables('policySetDefinitions')[copyIndex()].properties.policyDefinitions]", + "policyDefinitionGroups": "[variables('policySetDefinitions')[copyIndex()].properties.policyDefinitionGroups]" + }, + "dependsOn": [ + "PolicyDefinitions" + ] + } + ], + "outputs": { + "policyDefinitionNames": { + "type": "array", + "copy": { + "count": "[length(variables('policyDefinitions'))]", + "input": "[variables('policyDefinitions')[copyIndex()].name]" + } + }, + "policySetDefinitionNames": { + "type": "array", + "copy": { + "count": "[length(variables('policySetDefinitions'))]", + "input": "[variables('policySetDefinitions')[copyIndex()].name]" + } + } + } +} \ No newline at end of file diff --git a/patterns/alz/policyDefinitions/policies-Monitoring.json b/patterns/alz/policyDefinitions/policies-Monitoring.json new file mode 100644 index 000000000..c81fddb3b --- /dev/null +++ b/patterns/alz/policyDefinitions/policies-Monitoring.json @@ -0,0 +1,226 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-08-01/managementGroupDeploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.29.47.4906", + "templateHash": "15633981339092932393" + } + }, + "parameters": { + "topLevelManagementGroupPrefix": { + "type": "string", + "defaultValue": "alz", + "metadata": { + "message": "The JSON version of this file is programatically generated from Bicep. PLEASE DO NOT UPDATE MANUALLY!!", + "description": "Provide a prefix (unique at tenant-scope) for the Management Group hierarchy and other resources created as part of an Azure landing zone. DEFAULT VALUE = \"alz\"" + } + }, + "location": { + "type": "string", + "defaultValue": "[deployment().location]", + "metadata": { + "description": "Optionally set the deployment location for policies with Deploy If Not Exists effect. DEFAULT VALUE = \"deployment().location\"" + } + }, + "scope": { + "type": "string", + "defaultValue": "[tenantResourceId('Microsoft.Management/managementGroups', parameters('topLevelManagementGroupPrefix'))]", + "metadata": { + "description": "Optionally set the scope for custom Policy Definitions used in Policy Set Definitions (Initiatives). Must be one of '/', '/subscriptions/id' or '/providers/Microsoft.Management/managementGroups/id'. DEFAULT VALUE = '/providers/Microsoft.Management/managementGroups/${topLevelManagementGroupPrefix}'" + } + } + }, + "variables": { + "copy": [ + { + "name": "processPolicyDefinitionsAll", + "count": "[length(variables('loadPolicyDefinitions').All)]", + "input": "[replace(replace(variables('loadPolicyDefinitions').All[copyIndex('processPolicyDefinitionsAll')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" + }, + { + "name": "processPolicyDefinitionsAzureCloud", + "count": "[length(variables('loadPolicyDefinitions').AzureCloud)]", + "input": "[replace(replace(variables('loadPolicyDefinitions').AzureCloud[copyIndex('processPolicyDefinitionsAzureCloud')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" + }, + { + "name": "processPolicyDefinitionsAzureChinaCloud", + "count": "[length(variables('loadPolicyDefinitions').AzureChinaCloud)]", + "input": "[replace(replace(variables('loadPolicyDefinitions').AzureChinaCloud[copyIndex('processPolicyDefinitionsAzureChinaCloud')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" + }, + { + "name": "processPolicyDefinitionsAzureUSGovernment", + "count": "[length(variables('loadPolicyDefinitions').AzureUSGovernment)]", + "input": "[replace(replace(variables('loadPolicyDefinitions').AzureUSGovernment[copyIndex('processPolicyDefinitionsAzureUSGovernment')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" + }, + { + "name": "processPolicySetDefinitionsAll", + "count": "[length(variables('loadPolicySetDefinitions').All)]", + "input": "[replace(variables('loadPolicySetDefinitions').All[copyIndex('processPolicySetDefinitionsAll')], variables('templateVars').scope, parameters('scope'))]" + }, + { + "name": "processPolicySetDefinitionsAzureCloud", + "count": "[length(variables('loadPolicySetDefinitions').AzureCloud)]", + "input": "[replace(variables('loadPolicySetDefinitions').AzureCloud[copyIndex('processPolicySetDefinitionsAzureCloud')], variables('templateVars').scope, parameters('scope'))]" + }, + { + "name": "processPolicySetDefinitionsAzureChinaCloud", + "count": "[length(variables('loadPolicySetDefinitions').AzureChinaCloud)]", + "input": "[replace(variables('loadPolicySetDefinitions').AzureChinaCloud[copyIndex('processPolicySetDefinitionsAzureChinaCloud')], variables('templateVars').scope, parameters('scope'))]" + }, + { + "name": "processPolicySetDefinitionsAzureUSGovernment", + "count": "[length(variables('loadPolicySetDefinitions').AzureUSGovernment)]", + "input": "[replace(variables('loadPolicySetDefinitions').AzureUSGovernment[copyIndex('processPolicySetDefinitionsAzureUSGovernment')], variables('templateVars').scope, parameters('scope'))]" + }, + { + "name": "policyDefinitionsAll", + "count": "[length(variables('processPolicyDefinitionsAll'))]", + "input": "[json(variables('processPolicyDefinitionsAll')[copyIndex('policyDefinitionsAll')])]" + }, + { + "name": "policyDefinitionsAzureCloud", + "count": "[length(variables('processPolicyDefinitionsAzureCloud'))]", + "input": "[json(variables('processPolicyDefinitionsAzureCloud')[copyIndex('policyDefinitionsAzureCloud')])]" + }, + { + "name": "policyDefinitionsAzureChinaCloud", + "count": "[length(variables('processPolicyDefinitionsAzureChinaCloud'))]", + "input": "[json(variables('processPolicyDefinitionsAzureChinaCloud')[copyIndex('policyDefinitionsAzureChinaCloud')])]" + }, + { + "name": "policyDefinitionsAzureUSGovernment", + "count": "[length(variables('processPolicyDefinitionsAzureUSGovernment'))]", + "input": "[json(variables('processPolicyDefinitionsAzureUSGovernment')[copyIndex('policyDefinitionsAzureUSGovernment')])]" + }, + { + "name": "policySetDefinitionsAll", + "count": "[length(variables('processPolicySetDefinitionsAll'))]", + "input": "[json(variables('processPolicySetDefinitionsAll')[copyIndex('policySetDefinitionsAll')])]" + }, + { + "name": "policySetDefinitionsAzureCloud", + "count": "[length(variables('processPolicySetDefinitionsAzureCloud'))]", + "input": "[json(variables('processPolicySetDefinitionsAzureCloud')[copyIndex('policySetDefinitionsAzureCloud')])]" + }, + { + "name": "policySetDefinitionsAzureChinaCloud", + "count": "[length(variables('processPolicySetDefinitionsAzureChinaCloud'))]", + "input": "[json(variables('processPolicySetDefinitionsAzureChinaCloud')[copyIndex('policySetDefinitionsAzureChinaCloud')])]" + }, + { + "name": "policySetDefinitionsAzureUSGovernment", + "count": "[length(variables('processPolicySetDefinitionsAzureUSGovernment'))]", + "input": "[json(variables('processPolicySetDefinitionsAzureUSGovernment')[copyIndex('policySetDefinitionsAzureUSGovernment')])]" + } + ], + "$fxv#0": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_activitylog_LAWorkspace_Delete\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Activity Log LA Workspace Delete Alert\",\n \"description\": \"Policy to Deploy Activity Log LA Workspace Delete Alert\",\n \"metadata\": {\n \"version\": \"1.1.0\",\n \"category\": \"Monitoring\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"_deployed_by_amba\": true\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.OperationalInsights/workspaces\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/activityLogAlerts\",\n \"name\": \"ActivityLAWorkspaceDelete\",\n \"existenceScope\": \"resourcegroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"count\": {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*]\",\n \"where\": {\n \"anyOf\": [\n {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].field\",\n \"equals\": \"category\"\n },\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].equals\",\n \"equals\": \"Administrative\"\n }\n ]\n },\n {\n \"allOf\": [\n {\n \"field\": \"microsoft.insights/activityLogAlerts/condition.allOf[*].field\",\n \"equals\": \"operationName\"\n },\n {\n \"field\": \"microsoft.insights/activityLogAlerts/condition.allOf[*].equals\",\n \"equals\": \"Microsoft.OperationalInsights/workspaces/delete\"\n }\n ]\n }\n ]\n }\n },\n \"equals\": 2\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"enabled\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"ActivityLAWorkspaceDelete\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"microsoft.insights/activityLogAlerts\",\n \"apiVersion\": \"2020-10-01\",\n \"name\": \"ActivityLAWorkspaceDelete\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Activity Log LA Workspace Delete\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().id]\"\n ],\n \"condition\": {\n \"allOf\": [\n {\n \"field\": \"category\",\n \"equals\": \"Administrative\"\n },\n {\n \"field\": \"operationName\",\n \"equals\": \"Microsoft.OperationalInsights/workspaces/delete\"\n },\n {\n \"field\": \"status\",\n \"containsAny\": [\n \"succeeded\"\n ]\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#1": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_activitylog_LAWorkspace_KeyRegen\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Activity Log LA Workspace Regenerate Key Alert\",\n \"description\": \"Policy to Deploy Activity Log LA Workspace Regenerate Key Alert\",\n \"metadata\": {\n \"version\": \"1.1.0\",\n \"category\": \"Monitoring\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.OperationalInsights/workspaces\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/activityLogAlerts\",\n \"name\": \"ActivityLAWorkspaceRegenKey\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"count\": {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*]\",\n \"where\": {\n \"anyOf\": [\n {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].field\",\n \"equals\": \"category\"\n },\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].equals\",\n \"equals\": \"Administrative\"\n }\n ]\n },\n {\n \"allOf\": [\n {\n \"field\": \"microsoft.insights/activityLogAlerts/condition.allOf[*].field\",\n \"equals\": \"operationName\"\n },\n {\n \"field\": \"microsoft.insights/activityLogAlerts/condition.allOf[*].equals\",\n \"equals\": \"Microsoft.OperationalInsights/workspaces/regeneratesharedkey/action\"\n }\n ]\n }\n ]\n }\n },\n \"equals\": 2\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"enabled\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"ActivityLAWorkspaceRegenKey\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"microsoft.insights/activityLogAlerts\",\n \"apiVersion\": \"2020-10-01\",\n \"name\": \"ActivityLAWorkspaceRegenKey\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Activity Log LA Workspace Regenerate Key\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().id]\"\n ],\n \"condition\": {\n \"allOf\": [\n {\n \"field\": \"category\",\n \"equals\": \"Administrative\"\n },\n {\n \"field\": \"operationName\",\n \"equals\": \"Microsoft.OperationalInsights/workspaces/regeneratesharedkey/action\"\n },\n {\n \"field\": \"status\",\n \"containsAny\": [\n \"succeeded\"\n ]\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#2": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_LAWorkspace_DailyCapLimitReached_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy LA Workspace Daily Cap Limit Reached Alert\",\n \"description\": \"Policy to audit/deploy LA Workspace Daily Cap Limit Reached Alert\",\n \"metadata\": {\n \"version\": \"1.0.0\",\n \"category\": \"Monitoring\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"UAMIResourceId\": {\n \"type\": \"string\",\n \"defaultValue\": \"\",\n \"metadata\": {\n \"description\": \"The resource Id of the user assigned managed identity.\",\n \"displayName\": \"User Assigned managed Identity resource Id.\"\n }\n },\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"operator\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Operator\"\n },\n \"allowedValues\": [\n \"GreaterThan\",\n \"GreaterThanOrEqual\"\n ],\n \"defaultValue\": \"GreaterThan\"\n },\n \"timeAggregation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"TimeAggregation\"\n },\n \"allowedValues\": [\n \"Count\"\n ],\n \"defaultValue\": \"Count\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT10M\",\n \"PT15M\",\n \"PT30M\",\n \"PT45M\",\n \"PT1H\",\n \"PT2H\",\n \"PT3H\",\n \"PT4H\",\n \"PT5H\",\n \"PT6H\",\n \"P1D\"\n ],\n \"defaultValue\": \"P1D\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT5M\",\n \"PT10M\",\n \"PT15M\",\n \"PT30M\",\n \"PT45M\",\n \"PT1H\",\n \"PT2H\",\n \"PT3H\",\n \"PT4H\",\n \"PT5H\",\n \"PT6H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT1H\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"0\"\n },\n \"failingPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Failing Periods\",\n \"description\": \"Number of failing periods before alert is fired\"\n },\n \"defaultValue\": \"1\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Periods\",\n \"description\": \"The number of aggregated lookback points.\"\n },\n \"defaultValue\": \"1\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.OperationalInsights/workspaces\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.OperationalInsights/workspaces/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold\",\n \"equals\": \"[[parameters('threshold')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\n \"equals\": \"[[parameters('operator')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\n \"equals\": \"[[parameters('timeAggregation')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": \"[[parameters('evaluationPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": \"[[parameters('failingPeriods')]\"\n },\n {\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\n \"equals\": \"[[format('let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.OperationalInsights/workspaces\\\" | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\") | project customerId = tostring(properties.customerId)); let workspaceResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.OperationalInsights/workspaces\\\" | project id, customerId = tostring(properties.customerId), workspaceName = tostring(name)); Operation | where TenantId !in~ (excludedResources) | where OperationCategory == \\\"Data Collection Status\\\" | where Detail has_any(\\\"RespectQuota\\\", \\\"OverQuota\\\") | summarize arg_max(TimeGenerated, *) by TenantId | where Detail has \\\"OverQuota\\\" | join hint.remote=left kind=inner workspaceResources on $left.TenantId == $right.customerId | project TimeGenerated, id, workspaceName, workspaceId = TenantId, Detail', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'))]\"\n },\n {\n \"field\": \"identity.userAssignedIdentities\",\n \"containsKey\": \"[[parameters('UAMIResourceId')]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"resourceLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceLocation\",\n \"description\": \"Location of the resource\"\n }\n },\n \"UAMIResourceId\": {\n \"type\": \"string\"\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n },\n \"operator\": {\n \"type\": \"String\"\n },\n \"timeAggregation\": {\n \"type\": \"String\"\n },\n \"failingPeriods\": {\n \"type\": \"String\"\n },\n \"evaluationPeriods\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\n \"apiVersion\": \"2022-08-01-preview\",\n \"name\": \"[[concat(parameters('resourceName'), '-DailyCapLimitReachedAlert')]\",\n \"location\": \"[[parameters('resourceLocation')]\",\n \"identity\": {\n \"type\": \"UserAssigned\",\n \"userAssignedIdentities\": {\n \"[[parameters('UAMIResourceId')]\": {}\n }\n },\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"displayName\": \"[[concat(parameters('resourceName'), '-DailyCapLimitReachedAlert')]\",\n \"description\": \"Log Alert for Daily Cap Limit Reached\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"query\": \"[[format('let excludedResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.OperationalInsights/workspaces\\\" | where parse_json(tostring(tags.{0})) in~ (\\\"{1}\\\") | project customerId = tostring(properties.customerId)); let workspaceResources = (arg(\\\"\\\").resources | where type =~ \\\"Microsoft.OperationalInsights/workspaces\\\" | project id, customerId = tostring(properties.customerId), workspaceName = tostring(name)); Operation | where TenantId !in~ (excludedResources) | where OperationCategory == \\\"Data Collection Status\\\" | where Detail has_any(\\\"RespectQuota\\\", \\\"OverQuota\\\") | summarize arg_max(TimeGenerated, *) by TenantId | where Detail has \\\"OverQuota\\\" | join hint.remote=left kind=inner workspaceResources on $left.TenantId == $right.customerId | project TimeGenerated, id, workspaceName, workspaceId = TenantId, Detail', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\\\",\\\"'))]\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"operator\": \"[[parameters('operator')]\",\n \"dimensions\": [\n {\n \"name\": \"workspaceName\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ],\n \"resourceIdColumn\": \"id\",\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\n }\n }\n ]\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"resourceLocation\": {\n \"value\": \"[[field('location')]\"\n },\n \"UAMIResourceId\": {\n \"value\": \"[[parameters('UAMIResourceId')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n },\n \"operator\": {\n \"value\": \"[[parameters('operator')]\"\n },\n \"timeAggregation\": {\n \"value\": \"[[parameters('timeAggregation')]\"\n },\n \"failingPeriods\": {\n \"value\": \"[[parameters('failingPeriods')]\"\n },\n \"evaluationPeriods\": {\n \"value\": \"[[parameters('evaluationPeriods')]\"\n },\n \"MonitorDisableTagName\": {\n \"value\": \"[[parameters('MonitorDisableTagName')]\"\n },\n \"MonitorDisableTagValues\": {\n \"value\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "cloudEnv": "[environment().name]", + "defaultDeploymentLocationByCloudType": { + "AzureCloud": "northeurope", + "AzureChinaCloud": "chinaeast2", + "AzureUSGovernment": "usgovvirginia" + }, + "templateVars": { + "scope": "/providers/Microsoft.Management/managementGroups/contoso", + "defaultDeploymentLocation": "\"location\": \"northeurope\"", + "localizedDeploymentLocation": "[format('\"location\": \"{0}\"', variables('defaultDeploymentLocationByCloudType')[variables('cloudEnv')])]" + }, + "targetDeploymentLocationByCloudType": { + "AzureCloud": "[coalesce(parameters('location'), 'northeurope')]", + "AzureChinaCloud": "[coalesce(parameters('location'), 'chinaeast2')]", + "AzureUSGovernment": "[coalesce(parameters('location'), 'usgovvirginia')]" + }, + "deploymentLocation": "[format('\"location\": \"{0}\"', variables('targetDeploymentLocationByCloudType')[variables('cloudEnv')])]", + "loadPolicyDefinitions": { + "All": [ + "[variables('$fxv#0')]", + "[variables('$fxv#1')]", + "[variables('$fxv#2')]" + ], + "AzureCloud": [], + "AzureChinaCloud": [], + "AzureUSGovernment": [] + }, + "loadPolicySetDefinitions": { + "All": [], + "AzureCloud": [], + "AzureChinaCloud": [], + "AzureUSGovernment": [] + }, + "policyDefinitionsByCloudType": { + "All": "[variables('policyDefinitionsAll')]", + "AzureCloud": "[variables('policyDefinitionsAzureCloud')]", + "AzureChinaCloud": "[variables('policyDefinitionsAzureChinaCloud')]", + "AzureUSGovernment": "[variables('policyDefinitionsAzureUSGovernment')]" + }, + "policySetDefinitionsByCloudType": { + "All": "[variables('policySetDefinitionsAll')]", + "AzureCloud": "[variables('policySetDefinitionsAzureCloud')]", + "AzureChinaCloud": "[variables('policySetDefinitionsAzureChinaCloud')]", + "AzureUSGovernment": "[variables('policySetDefinitionsAzureUSGovernment')]" + }, + "policyDefinitions": "[concat(variables('policyDefinitionsByCloudType').All, variables('policyDefinitionsByCloudType')[variables('cloudEnv')])]", + "policySetDefinitions": "[concat(variables('policySetDefinitionsByCloudType').All, variables('policySetDefinitionsByCloudType')[variables('cloudEnv')])]" + }, + "resources": [ + { + "copy": { + "name": "PolicyDefinitions", + "count": "[length(variables('policyDefinitions'))]" + }, + "type": "Microsoft.Authorization/policyDefinitions", + "apiVersion": "2020-09-01", + "name": "[variables('policyDefinitions')[copyIndex()].name]", + "properties": { + "description": "[variables('policyDefinitions')[copyIndex()].properties.description]", + "displayName": "[variables('policyDefinitions')[copyIndex()].properties.displayName]", + "metadata": "[variables('policyDefinitions')[copyIndex()].properties.metadata]", + "mode": "[variables('policyDefinitions')[copyIndex()].properties.mode]", + "parameters": "[variables('policyDefinitions')[copyIndex()].properties.parameters]", + "policyType": "[variables('policyDefinitions')[copyIndex()].properties.policyType]", + "policyRule": "[variables('policyDefinitions')[copyIndex()].properties.policyRule]" + } + }, + { + "copy": { + "name": "PolicySetDefinitions", + "count": "[length(variables('policySetDefinitions'))]" + }, + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2020-09-01", + "name": "[variables('policySetDefinitions')[copyIndex()].name]", + "properties": { + "description": "[variables('policySetDefinitions')[copyIndex()].properties.description]", + "displayName": "[variables('policySetDefinitions')[copyIndex()].properties.displayName]", + "metadata": "[variables('policySetDefinitions')[copyIndex()].properties.metadata]", + "parameters": "[variables('policySetDefinitions')[copyIndex()].properties.parameters]", + "policyType": "[variables('policySetDefinitions')[copyIndex()].properties.policyType]", + "policyDefinitions": "[variables('policySetDefinitions')[copyIndex()].properties.policyDefinitions]", + "policyDefinitionGroups": "[variables('policySetDefinitions')[copyIndex()].properties.policyDefinitionGroups]" + }, + "dependsOn": [ + "PolicyDefinitions" + ] + } + ], + "outputs": { + "policyDefinitionNames": { + "type": "array", + "copy": { + "count": "[length(variables('policyDefinitions'))]", + "input": "[variables('policyDefinitions')[copyIndex()].name]" + } + }, + "policySetDefinitionNames": { + "type": "array", + "copy": { + "count": "[length(variables('policySetDefinitions'))]", + "input": "[variables('policySetDefinitions')[copyIndex()].name]" + } + } + } +} \ No newline at end of file diff --git a/patterns/alz/policyDefinitions/policies-Network.json b/patterns/alz/policyDefinitions/policies-Network.json new file mode 100644 index 000000000..a5ae83cb5 --- /dev/null +++ b/patterns/alz/policyDefinitions/policies-Network.json @@ -0,0 +1,7874 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-08-01/managementGroupDeploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.29.47.4906", + "templateHash": "16712450722818524666" + } + }, + "parameters": { + "topLevelManagementGroupPrefix": { + "type": "string", + "defaultValue": "alz", + "metadata": { + "message": "The JSON version of this file is programatically generated from Bicep. PLEASE DO NOT UPDATE MANUALLY!!", + "description": "Provide a prefix (unique at tenant-scope) for the Management Group hierarchy and other resources created as part of an Azure landing zone. DEFAULT VALUE = \"alz\"" + } + }, + "location": { + "type": "string", + "defaultValue": "[deployment().location]", + "metadata": { + "description": "Optionally set the deployment location for policies with Deploy If Not Exists effect. DEFAULT VALUE = \"deployment().location\"" + } + }, + "scope": { + "type": "string", + "defaultValue": "[tenantResourceId('Microsoft.Management/managementGroups', parameters('topLevelManagementGroupPrefix'))]", + "metadata": { + "description": "Optionally set the scope for custom Policy Definitions used in Policy Set Definitions (Initiatives). Must be one of '/', '/subscriptions/id' or '/providers/Microsoft.Management/managementGroups/id'. DEFAULT VALUE = '/providers/Microsoft.Management/managementGroups/${topLevelManagementGroupPrefix}'" + } + } + }, + "variables": { + "copy": [ + { + "name": "processPolicyDefinitionsAll", + "count": "[length(variables('loadPolicyDefinitions').All)]", + "input": "[replace(replace(variables('loadPolicyDefinitions').All[copyIndex('processPolicyDefinitionsAll')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" + }, + { + "name": "processPolicyDefinitionsAzureCloud", + "count": "[length(variables('loadPolicyDefinitions').AzureCloud)]", + "input": "[replace(replace(variables('loadPolicyDefinitions').AzureCloud[copyIndex('processPolicyDefinitionsAzureCloud')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" + }, + { + "name": "processPolicyDefinitionsAzureChinaCloud", + "count": "[length(variables('loadPolicyDefinitions').AzureChinaCloud)]", + "input": "[replace(replace(variables('loadPolicyDefinitions').AzureChinaCloud[copyIndex('processPolicyDefinitionsAzureChinaCloud')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" + }, + { + "name": "processPolicyDefinitionsAzureUSGovernment", + "count": "[length(variables('loadPolicyDefinitions').AzureUSGovernment)]", + "input": "[replace(replace(variables('loadPolicyDefinitions').AzureUSGovernment[copyIndex('processPolicyDefinitionsAzureUSGovernment')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" + }, + { + "name": "processPolicySetDefinitionsAll", + "count": "[length(variables('loadPolicySetDefinitions').All)]", + "input": "[replace(variables('loadPolicySetDefinitions').All[copyIndex('processPolicySetDefinitionsAll')], variables('templateVars').scope, parameters('scope'))]" + }, + { + "name": "processPolicySetDefinitionsAzureCloud", + "count": "[length(variables('loadPolicySetDefinitions').AzureCloud)]", + "input": "[replace(variables('loadPolicySetDefinitions').AzureCloud[copyIndex('processPolicySetDefinitionsAzureCloud')], variables('templateVars').scope, parameters('scope'))]" + }, + { + "name": "processPolicySetDefinitionsAzureChinaCloud", + "count": "[length(variables('loadPolicySetDefinitions').AzureChinaCloud)]", + "input": "[replace(variables('loadPolicySetDefinitions').AzureChinaCloud[copyIndex('processPolicySetDefinitionsAzureChinaCloud')], variables('templateVars').scope, parameters('scope'))]" + }, + { + "name": "processPolicySetDefinitionsAzureUSGovernment", + "count": "[length(variables('loadPolicySetDefinitions').AzureUSGovernment)]", + "input": "[replace(variables('loadPolicySetDefinitions').AzureUSGovernment[copyIndex('processPolicySetDefinitionsAzureUSGovernment')], variables('templateVars').scope, parameters('scope'))]" + }, + { + "name": "policyDefinitionsAll", + "count": "[length(variables('processPolicyDefinitionsAll'))]", + "input": "[json(variables('processPolicyDefinitionsAll')[copyIndex('policyDefinitionsAll')])]" + }, + { + "name": "policyDefinitionsAzureCloud", + "count": "[length(variables('processPolicyDefinitionsAzureCloud'))]", + "input": "[json(variables('processPolicyDefinitionsAzureCloud')[copyIndex('policyDefinitionsAzureCloud')])]" + }, + { + "name": "policyDefinitionsAzureChinaCloud", + "count": "[length(variables('processPolicyDefinitionsAzureChinaCloud'))]", + "input": "[json(variables('processPolicyDefinitionsAzureChinaCloud')[copyIndex('policyDefinitionsAzureChinaCloud')])]" + }, + { + "name": "policyDefinitionsAzureUSGovernment", + "count": "[length(variables('processPolicyDefinitionsAzureUSGovernment'))]", + "input": "[json(variables('processPolicyDefinitionsAzureUSGovernment')[copyIndex('policyDefinitionsAzureUSGovernment')])]" + }, + { + "name": "policySetDefinitionsAll", + "count": "[length(variables('processPolicySetDefinitionsAll'))]", + "input": "[json(variables('processPolicySetDefinitionsAll')[copyIndex('policySetDefinitionsAll')])]" + }, + { + "name": "policySetDefinitionsAzureCloud", + "count": "[length(variables('processPolicySetDefinitionsAzureCloud'))]", + "input": "[json(variables('processPolicySetDefinitionsAzureCloud')[copyIndex('policySetDefinitionsAzureCloud')])]" + }, + { + "name": "policySetDefinitionsAzureChinaCloud", + "count": "[length(variables('processPolicySetDefinitionsAzureChinaCloud'))]", + "input": "[json(variables('processPolicySetDefinitionsAzureChinaCloud')[copyIndex('policySetDefinitionsAzureChinaCloud')])]" + }, + { + "name": "policySetDefinitionsAzureUSGovernment", + "count": "[length(variables('processPolicySetDefinitionsAzureUSGovernment'))]", + "input": "[json(variables('processPolicySetDefinitionsAzureUSGovernment')[copyIndex('policySetDefinitionsAzureUSGovernment')])]" + } + ], + "$fxv#0": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_activitylog_Firewall_Delete\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Activity Log Azure FireWall Delete Alert\",\n \"description\": \"Policy to Deploy Activity Log Azure Firewall Delete Alert\",\n \"metadata\": {\n \"version\": \"1.1.0\",\n \"category\": \"Network\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/azureFirewalls\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/activityLogAlerts\",\n \"name\": \"ActivityAzureFirewallDelete\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"count\": {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*]\",\n \"where\": {\n \"anyOf\": [\n {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].field\",\n \"equals\": \"category\"\n },\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].equals\",\n \"equals\": \"Administrative\"\n }\n ]\n },\n {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].field\",\n \"equals\": \"operationName\"\n },\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].equals\",\n \"equals\": \"Microsoft.Network/azureFirewalls/delete\"\n }\n ]\n }\n ]\n }\n },\n \"equals\": 2\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"enabled\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2020-10-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"ActivityAzureFirewallDelete\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"microsoft.insights/activityLogAlerts\",\n \"apiVersion\": \"2020-10-01\",\n \"name\": \"ActivityAzureFirewallDelete\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Activity Log Firewall Delete\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().id]\"\n ],\n \"condition\": {\n \"allOf\": [\n {\n \"field\": \"category\",\n \"equals\": \"Administrative\"\n },\n {\n \"field\": \"operationName\",\n \"equals\": \"Microsoft.Network/azurefirewalls/delete\"\n },\n {\n \"field\": \"status\",\n \"containsAny\": [\n \"succeeded\"\n ]\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#1": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_AFW_FirewallHealth_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy AFW FirewallHealth Alert\",\n \"description\": \"Policy to audit/deploy Azure Firewall FirewallHealth Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Network\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"0\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT1M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"90\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/azureFirewalls\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Network/azureFirewalls\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"FirewallHealth\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/azureFirewalls/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\n \"equals\": \"LessThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-FirewallHealth-threshold-Override_'), field('tags._amba-FirewallHealth-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-FirewallHealth')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for AFW FirewallHealth\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"FirewallHealth\",\n \"metricNamespace\": \"Microsoft.Network/azureFirewalls\",\n \"metricName\": \"FirewallHealth\",\n \"operator\": \"LessThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-FirewallHealth-threshold-Override_'), field('tags._amba-FirewallHealth-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#10": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_ERP_ExpressRouteBitsIn_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy ER Direct ExpressRoute Bits In Alert\",\n \"description\": \"Policy to audit/deploy ER Direct Connection BitsInPerSecond Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"Category\": \"Networking\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"0\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"1\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"disabled\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/expressRoutePorts\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Network/expressRoutePorts\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"PortBitsInPerSecond\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/expressRoutePorts/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\n \"equals\": \"LessThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-PortBitsInPerSecond-threshold-Override_'), field('tags._amba-PortBitsInPerSecond-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-DirectERBitsInAlert')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for ER Direct Connection BitsInPerSecond\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"PortBitsInPerSecond\",\n \"metricNamespace\": \"Microsoft.Network/expressRoutePorts\",\n \"metricName\": \"PortBitsInPerSecond\",\n \"operator\": \"LessThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-PortBitsInPerSecond-threshold-Override_'), field('tags._amba-PortBitsInPerSecond-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#11": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_ERP_ExpressRouteBitsOut_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy ER Direct ExpressRoute Bits Out Alert\",\n \"description\": \"Policy to audit/deploy ER Direct Connection BitsOutPerSecond Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"Category\": \"Networking\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"0\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"1\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"disabled\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/expressRoutePorts\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Network/expressRoutePorts\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"PortBitsOutPerSecond\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/expressRoutePorts/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\n \"equals\": \"LessThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-PortBitsOutPerSecond-threshold-Override_'), field('tags._amba-PortBitsOutPerSecond-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-DirectERBitsOutAlert')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for ER Direct Connection BitsOutPerSecond\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"PortBitsOutPerSecond\",\n \"metricNamespace\": \"Microsoft.Network/expressRoutePorts\",\n \"metricName\": \"PortBitsOutPerSecond\",\n \"operator\": \"LessThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-PortBitsOutPerSecond-threshold-Override_'), field('tags._amba-PortBitsOutPerSecond-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#12": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_ERP_ExpressRoutLineProtocol_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy ER Direct ExpressRoute LineProtocol Alert\",\n \"description\": \"Policy to audit/deploy ER Direct LineProtocol Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"Category\": \"Networking\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"0\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"0.9\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"disabled\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/expressRoutePorts\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Network/expressRoutePorts\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"LineProtocol\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/expressRoutePorts/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\n \"equals\": \"LessThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-LineProtocol-threshold-Override_'), field('tags._amba-LineProtocol-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-DirectERLineProtocolAlert')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for ER Direct Connection LineProtocolPerSecond\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"LineProtocol\",\n \"metricNamespace\": \"Microsoft.Network/expressRoutePorts\",\n \"metricName\": \"LineProtocol\",\n \"operator\": \"LessThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-LineProtocol-threshold-Override_'), field('tags._amba-LineProtocol-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#13": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_ERP_ExpressRoutRxLightLevel_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy ER Direct ExpressRoute RxLightLevel High Alert\",\n \"description\": \"Policy to audit/deploy ER Direct RxLightLevel High Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Networking\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"1\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"0\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"disabled\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/expressRoutePorts\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Network/expressRoutePorts\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"RxLightLevel\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\n \"equals\": \"GreaterThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/expressRoutePorts/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\n \"equals\": \"GreaterThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-RxLightLevel-High-threshold-Override_'), field('tags._amba-RxLightLevel-High-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-DirectERRxLightLevelHighAlert')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for ER Direct Connection RxLightLevelHigh\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"RxLightLevel\",\n \"metricNamespace\": \"Microsoft.Network/expressRoutePorts\",\n \"metricName\": \"RxLightLevel\",\n \"operator\": \"GreaterThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-RxLightLevel-High-threshold-Override_'), field('tags._amba-RxLightLevel-High-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#14": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_ERP_ExpressRoutRxLightLevellow_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy ER Direct ExpressRoute RxLightLevel Low Alert\",\n \"description\": \"Policy to audit/deploy ER Direct RxLightLevel Low Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"Category\": \"Networking\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"1\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"-10\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"disabled\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/expressRoutePorts\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Network/expressRoutePorts\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"RxLightLevel\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\n \"equals\": \"LessThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/expressRoutePorts/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\n \"equals\": \"LessThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-RxLightLevel-Low-threshold-Override_'), field('tags._amba-RxLightLevel-Low-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-DirectERRxLightLevelLowAlert')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for ER Direct Connection RxLightLevelLow\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"RxLightLevel\",\n \"metricNamespace\": \"Microsoft.Network/expressRoutePorts\",\n \"metricName\": \"RxLightLevel\",\n \"operator\": \"LessThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-RxLightLevel-Low-threshold-Override_'), field('tags._amba-RxLightLevel-Low-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#15": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_ERP_ExpressRoutTxLightLevell_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy ER Direct ExpressRoute TxLightLevel High Alert\",\n \"description\": \"Policy to audit/deploy ER Direct TxLightLevel High Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"Category\": \"Networking\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"1\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"0\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"disabled\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/expressRoutePorts\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Network/expressRoutePorts\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"TxLightLevel\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\n \"equals\": \"GreaterThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/expressRoutePorts/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\n \"equals\": \"GreaterThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-TxLightLevel-High-threshold-Override_'), field('tags._amba-TxLightLevel-High-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-DirectERTxLightLevelHighAlert')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for ER Direct Connection TxLightLevelHigh\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"TxLightLevel\",\n \"metricNamespace\": \"Microsoft.Network/expressRoutePorts\",\n \"metricName\": \"TxLightLevel\",\n \"operator\": \"GreaterThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-TxLightLevel-High-threshold-Override_'), field('tags._amba-TxLightLevel-High-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#16": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_ERP_ExpressRoutTxLightLevellow_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy ER Direct ExpressRoute TxLightLevel Low Alert\",\n \"description\": \"Policy to audit/deploy ER Direct TxLightLevel Low Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"Category\": \"Networking\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"1\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"-10\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"disabled\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/expressRoutePorts\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Network/expressRoutePorts\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"TxLightLevel\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\n \"equals\": \"LessThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/expressRoutePorts/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\n \"equals\": \"LessThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-TxLightLevel-Low-threshold-Override_'), field('tags._amba-TxLightLevel-Low-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-DirectERTxLightLevelLowAlert')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for ER Direct Connection TxLightLevelLow\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"TxLightLevel\",\n \"metricNamespace\": \"Microsoft.Network/expressRoutePorts\",\n \"metricName\": \"TxLightLevel\",\n \"operator\": \"LessThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-TxLightLevel-Low-threshold-Override_'), field('tags._amba-TxLightLevel-Low-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#17": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_PDNSZ_CapacityUtil_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy PDNSZ Capacity Utilization Alert\",\n \"description\": \"Policy to audit/deploy Private DNS Zone Capacity Utilization Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Network\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT1H\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT1H\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"80\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/privateDnsZones\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Network/privateDnsZones\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"VirtualNetworkLinkCapacityUtilization\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/privateDnsZones/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Maximum\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\n \"equals\": \"GreaterThanOrEqual\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-VirtualNetworkLinkCapacityUtilization-threshold-Override_'), field('tags._amba-VirtualNetworkLinkCapacityUtilization-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-CapacityUtilizationAlert')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for Private DNS Zone Virtual Network Link Capacity Utilization\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"VirtualNetworkLinkCapacityUtilization\",\n \"metricNamespace\": \"Microsoft.Network/privateDnsZones\",\n \"metricName\": \"VirtualNetworkLinkCapacityUtilization\",\n \"operator\": \"GreaterThanOrEqual\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Maximum\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-VirtualNetworkLinkCapacityUtilization-threshold-Override_'), field('tags._amba-VirtualNetworkLinkCapacityUtilization-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#18": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_PDNSZ_QueryVolume_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy PDNSZ Query Volume Alert\",\n \"description\": \"Policy to audit/deploy Private DNS Zone Query Volume Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Network\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"4\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT1H\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT1H\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"500\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"disabled\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/privateDnsZones\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Network/privateDnsZones\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"QueryVolume\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/privateDnsZones/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Total\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\n \"equals\": \"GreaterThanOrEqual\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-QueryVolume-threshold-Override_'), field('tags._amba-QueryVolume-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-QueryVolumeAlert')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for Private DNS Query Volume\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"QueryVolume\",\n \"metricNamespace\": \"Microsoft.Network/privateDnsZones\",\n \"metricName\": \"QueryVolume\",\n \"operator\": \"GreaterThanOrEqual\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Total\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-QueryVolume-threshold-Override_'), field('tags._amba-QueryVolume-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#19": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_PDNSZ_RecordSetCapacity_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy PDNSZ Record Set Capacity Alert\",\n \"description\": \"Policy to audit/deploy Private DNS Zone Record Set Capacity Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Network\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT1H\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT1H\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"80\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/privateDnsZones\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Network/privateDnsZones\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"RecordSetCapacityUtilization\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/privateDnsZones/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Maximum\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\n \"equals\": \"GreaterThanOrEqual\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-RecordSetCapacityUtilization-threshold-Override_'), field('tags._amba-RecordSetCapacityUtilization-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-RecordSet_Capacity_Utilization')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for Private DNS Zone Record Set Capacity Utilization\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"RecordSetCapacityUtilization\",\n \"metricNamespace\": \"Microsoft.Network/privateDnsZones\",\n \"metricName\": \"RecordSetCapacityUtilization\",\n \"operator\": \"GreaterThanOrEqual\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Maximum\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-RecordSetCapacityUtilization-threshold-Override_'), field('tags._amba-RecordSetCapacityUtilization-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#2": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_AFW_SNATPortUtilization_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy AFW SNATPortUtilization Alert\",\n \"description\": \"Policy to audit/deploy Azure Firewall SNATPortUtilization Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Network\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"1\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT1M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"80\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/azureFirewalls\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Network/azureFirewalls\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"SNATPortUtilization\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/azureFirewalls/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\n \"equals\": \"GreaterThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-SNATPortUtilization-threshold-Override_'), field('tags._amba-SNATPortUtilization-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-SNATPortUtilization')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for AFW SNATPortUtilization\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"SNATPortUtilization\",\n \"metricNamespace\": \"Microsoft.Network/azureFirewalls\",\n \"metricName\": \"SNATPortUtilization\",\n \"operator\": \"GreaterThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-SNATPortUtilization-threshold-Override_'), field('tags._amba-SNATPortUtilization-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#20": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_DNSZ_RegistrationCapacityUtil_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy PDNSZ Registration Capacity Utilization Alert\",\n \"description\": \"Policy to audit/deploy Private DNS Zone Registration Capacity Utilization Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Network\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT1H\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT1H\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"80\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/privateDnsZones\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Network/privateDnsZones\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"VirtualNetworkWithRegistrationCapacityUtilization\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/privateDnsZones/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Maximum\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\n \"equals\": \"GreaterThanOrEqual\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-VirtualNetworkWithRegistrationCapacityUtilization-threshold-Override_'), field('tags._amba-VirtualNetworkWithRegistrationCapacityUtilization-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-RequestsAlert')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for Private DNS Zone Registration Capacity Utilization\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"VirtualNetworkWithRegistrationCapacityUtilization\",\n \"metricNamespace\": \"Microsoft.Network/privateDnsZones\",\n \"metricName\": \"VirtualNetworkWithRegistrationCapacityUtilization\",\n \"operator\": \"GreaterThanOrEqual\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Maximum\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-VirtualNetworkWithRegistrationCapacityUtilization-threshold-Override_'), field('tags._amba-VirtualNetworkWithRegistrationCapacityUtilization-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#21": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VnetGw_ExpressRouteBitsPerSecond_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VNetG ExpressRoute Bits Per Second Alert\",\n \"description\": \"Policy to audit/deploy Virtual Network Gateway Express Route Bits Per Second Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Network\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"0\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT1M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"1\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/virtualNetworkGateways\"\n },\n {\n \"field\": \"Microsoft.Network/virtualNetworkGateways/gatewayType\",\n \"equals\": \"ExpressRoute\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Network/virtualNetworkGateways\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"ExpressRouteGatewayBitsPerSecond\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/virtualNetworkGateways/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].operator\",\n \"equals\": \"LessThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-ExpressRouteGatewayBitsPerSecond-threshold-Override_'), field('tags._amba-ExpressRouteGatewayBitsPerSecond-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-GatewayERBitsAlert')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for VNet Gateway Express Route Bits Per Second\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"ExpressRouteGatewayBitsPerSecond\",\n \"metricNamespace\": \"Microsoft.Network/virtualNetworkGateways\",\n \"metricName\": \"ExpressRouteGatewayBitsPerSecond\",\n \"operator\": \"LessThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-ExpressRouteGatewayBitsPerSecond-threshold-Override_'), field('tags._amba-ExpressRouteGatewayBitsPerSecond-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#22": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VnetGw_ExpressRouteCpuUtil_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VNetG ExpressRoute CPU Utilization Alert\",\n \"description\": \"Policy to audit/deploy Virtual Network Gateway Express Route CPU Utilization Alert\",\n \"metadata\": {\n \"version\": \"1.2.1\",\n \"category\": \"Network\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"1\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT1M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"80\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/virtualNetworkGateways\"\n },\n {\n \"field\": \"Microsoft.Network/virtualNetworkGateways/gatewayType\",\n \"equals\": \"ExpressRoute\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Network/virtualNetworkGateways\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"ExpressRouteGatewayCpuUtilization\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/virtualNetworkGateways/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].operator\",\n \"equals\": \"GreaterThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-ExpressRouteGatewayCpuUtilization-threshold-Override_'), field('tags._amba-ExpressRouteGatewayCpuUtilization-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-GatewayERCPUAlert')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for VNet Gateway Express Route CPU Utilization\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"ExpressRouteGatewayCpuUtilization\",\n \"metricNamespace\": \"Microsoft.Network/virtualNetworkGateways\",\n \"metricName\": \"ExpressRouteGatewayCpuUtilization\",\n \"operator\": \"GreaterThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-ExpressRouteGatewayCpuUtilization-threshold-Override_'), field('tags._amba-ExpressRouteGatewayCpuUtilization-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#23": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VnetGw_TunnelBandwidth_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VNetG Tunnel Bandwidth Alert\",\n \"description\": \"Policy to audit/deploy Virtual Network Gateway Tunnel Bandwidth Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Network\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"0\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT1M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"1\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/virtualNetworkGateways\"\n },\n {\n \"field\": \"Microsoft.Network/virtualNetworkGateways/gatewayType\",\n \"equals\": \"VPN\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Network/virtualNetworkGateways\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"TunnelAverageBandwidth\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/virtualNetworkGateways/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].operator\",\n \"equals\": \"LessThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-TunnelAverageBandwidth-threshold-Override_'), field('tags._amba-TunnelAverageBandwidth-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-TunnelBandwidthAlert')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for VNet Gateway Tunnel Avg Bandwidth\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"TunnelAverageBandwidth\",\n \"metricNamespace\": \"Microsoft.Network/virtualNetworkGateways\",\n \"metricName\": \"TunnelAverageBandwidth\",\n \"operator\": \"LessThan\",\n \"threshold\": \"[[if(contains(field('tags'), '_amba-TunnelAverageBandwidth-threshold-Override_'), field('tags._amba-TunnelAverageBandwidth-threshold-Override_'), parameters('threshold'))]\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#24": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VnetGw_TunnelEgress_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VNetG Tunnel Egress Alert\",\n \"description\": \"Policy to audit/deploy Virtual Network Gateway Tunnel Egress Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Network\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"0\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"1\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"disabled\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/virtualNetworkGateways\"\n },\n {\n \"field\": \"Microsoft.Network/virtualNetworkGateways/gatewayType\",\n \"equals\": \"VPN\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Network/virtualNetworkGateways\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"TunnelEgressBytes\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/virtualNetworkGateways/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].operator\",\n \"equals\": \"LessThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-TunnelEgressBytes-threshold-Override_'), field('tags._amba-TunnelEgressBytes-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-TunnelEgressAlert')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for VNet Gateway Tunnel Egress Bytes\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"TunnelEgressBytes\",\n \"metricNamespace\": \"Microsoft.Network/virtualNetworkGateways\",\n \"metricName\": \"TunnelEgressBytes\",\n \"operator\": \"LessThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-TunnelEgressBytes-threshold-Override_'), field('tags._amba-TunnelEgressBytes-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#25": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VnetGw_TunnelEgressPacketDropCount_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VNetG Egress Packet Drop Count Alert\",\n \"description\": \"Policy to audit/deploy Vnet Gateway Egress Packet Drop Count Alert\",\n \"metadata\": {\n \"version\": \"1.3.0\",\n \"category\": \"Network\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"3\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"microsoft.network/virtualNetworkGateways\"\n },\n {\n \"field\": \"Microsoft.Network/virtualNetworkGateways/gatewayType\",\n \"equals\": \"VPN\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"microsoft.network/virtualNetworkGateways\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"TunnelEgressPacketDropCount\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/microsoft.network/virtualNetworkGateways/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\n \"equals\": \"GreaterThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\n \"equals\": \"Medium\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": 4\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": 4\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-TunnelEgressPacketDropCountAlert')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for Vnet Gateway tunnel TunnelEgressPacketDropCount\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"alertSensitivity\": \"Medium\",\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": 4,\n \"minFailingPeriodsToAlert\": 4\n },\n \"name\": \"TunnelEgressPacketDropCount\",\n \"metricNamespace\": \"microsoft.network/virtualNetworkGateways\",\n \"metricName\": \"TunnelEgressPacketDropCount\",\n \"operator\": \"GreaterThan\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"DynamicThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#26": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VnetGw_TunnelEgressPacketDropMismatch_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VNetG Egress Packet Drop Mismatch Alert\",\n \"description\": \"Policy to audit/deploy Vnet Gateway Egress Packet Drop Mismatch Alert\",\n \"metadata\": {\n \"version\": \"1.3.0\",\n \"category\": \"Network\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"3\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"microsoft.network/virtualNetworkGateways\"\n },\n {\n \"field\": \"Microsoft.Network/virtualNetworkGateways/gatewayType\",\n \"equals\": \"VPN\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"microsoft.network/virtualNetworkGateways\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"TunnelEgressPacketDropTSMismatch\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/microsoft.network/virtualNetworkGateways/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\n \"equals\": \"GreaterThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\n \"equals\": \"Medium\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": 4\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": 4\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-TunnelEgressPacketDropTSMismatchAlert')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for Vnet Gateway tunnel TunnelEgressPacketDropTSMismatch\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"alertSensitivity\": \"Medium\",\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": 4,\n \"minFailingPeriodsToAlert\": 4\n },\n \"name\": \"TunnelEgressPacketDropTSMismatch\",\n \"metricNamespace\": \"microsoft.network/virtualNetworkGateways\",\n \"metricName\": \"TunnelEgressPacketDropTSMismatch\",\n \"operator\": \"GreaterThan\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"DynamicThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#27": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VnetGw_TunnelIngress_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VNetG Tunnel Ingress Alert\",\n \"description\": \"Policy to audit/deploy Virtual Network Gateway Tunnel Ingress Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Network\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"0\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"1\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"disabled\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/virtualNetworkGateways\"\n },\n {\n \"field\": \"Microsoft.Network/virtualNetworkGateways/gatewayType\",\n \"equals\": \"VPN\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Network/virtualNetworkGateways\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"TunnelIngressBytes\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/virtualNetworkGateways/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].operator\",\n \"equals\": \"LessThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-TunnelIngressBytes-threshold-Override_'), field('tags._amba-TunnelIngressBytes-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-TunnelIngressAlert')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for VNet Gateway Tunnel ingress Bytes\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"TunnelIngressBytes\",\n \"metricNamespace\": \"Microsoft.Network/virtualNetworkGateways\",\n \"metricName\": \"TunnelIngressBytes\",\n \"operator\": \"LessThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-TunnelIngressBytes-threshold-Override_'), field('tags._amba-TunnelIngressBytes-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#28": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VnetGw_TunnelIngressPacketDropCount_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VNetG Ingress Packet Drop Count Alert\",\n \"description\": \"Policy to audit/deploy Vnet Gateway Ingress Packet Drop Count Alert\",\n \"metadata\": {\n \"version\": \"1.3.0\",\n \"category\": \"Network\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"3\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"microsoft.network/virtualNetworkGateways\"\n },\n {\n \"field\": \"Microsoft.Network/virtualNetworkGateways/gatewayType\",\n \"equals\": \"VPN\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"microsoft.network/virtualNetworkGateways\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"TunnelIngressPacketDropCount\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/microsoft.network/virtualNetworkGateways/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\n \"equals\": \"GreaterThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\n \"equals\": \"Medium\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": 4\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": 4\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-TunnelIngressPacketDropCountAlert')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for Vnet Gateway tunnel TunnelIngressPacketDropCount\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"alertSensitivity\": \"Medium\",\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": 4,\n \"minFailingPeriodsToAlert\": 4\n },\n \"name\": \"TunnelIngressPacketDropCount\",\n \"metricNamespace\": \"microsoft.network/virtualNetworkGateways\",\n \"metricName\": \"TunnelIngressPacketDropCount\",\n \"operator\": \"GreaterThan\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"DynamicThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#29": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VnetGw_TunnelIngressPacketDropMismatch_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VNetG Ingress Packet Drop Mismatch Alert\",\n \"description\": \"Policy to audit/deploy Vnet Gateway Ingress Packet Drop Mismatch Alert\",\n \"metadata\": {\n \"version\": \"1.3.0\",\n \"category\": \"Network\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"3\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"microsoft.network/virtualNetworkGateways\"\n },\n {\n \"field\": \"Microsoft.Network/virtualNetworkGateways/gatewayType\",\n \"equals\": \"VPN\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"microsoft.network/virtualNetworkGateways\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"TunnelIngressPacketDropTSMismatch\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/microsoft.network/virtualNetworkGateways/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\n \"equals\": \"GreaterThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\n \"equals\": \"Medium\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": 4\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": 4\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-TunnelIngressPacketDropTSMismatchAlert')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for Vnet Gateway tunnel TunnelIngressPacketDropTSMismatch\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"alertSensitivity\": \"Medium\",\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": 4,\n \"minFailingPeriodsToAlert\": 4\n },\n \"name\": \"TunnelIngressPacketDropTSMismatch\",\n \"metricNamespace\": \"microsoft.network/virtualNetworkGateways\",\n \"metricName\": \"TunnelIngressPacketDropTSMismatch\",\n \"operator\": \"GreaterThan\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"DynamicThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#3": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_ERCIR_ArpAvailability_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy ExpressRoute Circuits Arp Availability Alert\",\n \"description\": \"Policy to audit/deploy ExpressRoute Circuits Arp Availability Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Network\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"0\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT1M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"90\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/expressRouteCircuits\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Network/expressRouteCircuits\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"ArpAvailability\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/expressRouteCircuits/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\n \"equals\": \"LessThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-ArpAvailability-threshold-Override_'), field('tags._amba-ArpAvailability-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-ArpAvailability')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for ExpressRoute Circuit Arp Availability\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"ArpAvailability\",\n \"metricNamespace\": \"Microsoft.Network/expressRouteCircuits\",\n \"metricName\": \"ArpAvailability\",\n \"operator\": \"LessThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-ArpAvailability-threshold-Override_'), field('tags._amba-ArpAvailability-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#30": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_activitylog_VPNGateway_Delete\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Activity Log VPN Gateway Delete Alert\",\n \"description\": \"Policy to Deploy Activity Log VPN Gateway Delete Alert\",\n \"metadata\": {\n \"version\": \"1.1.0\",\n \"category\": \"Network\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/vpnGateways\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/activityLogAlerts\",\n \"existenceScope\": \"resourcegroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"count\": {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*]\",\n \"where\": {\n \"anyOf\": [\n {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].field\",\n \"equals\": \"category\"\n },\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].equals\",\n \"equals\": \"Administrative\"\n }\n ]\n },\n {\n \"allOf\": [\n {\n \"field\": \"microsoft.insights/activityLogAlerts/condition.allOf[*].field\",\n \"equals\": \"operationName\"\n },\n {\n \"field\": \"microsoft.insights/activityLogAlerts/condition.allOf[*].equals\",\n \"equals\": \"Microsoft.Network/vpnGateways/delete\"\n }\n ]\n }\n ]\n }\n },\n \"equals\": 2\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"enabled\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"ActivityVPNGatewayDelete\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"microsoft.insights/activityLogAlerts\",\n \"apiVersion\": \"2020-10-01\",\n \"name\": \"ActivityVPNGatewayDelete\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Activity Log VPN Gateway Delete\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().id]\"\n ],\n \"condition\": {\n \"allOf\": [\n {\n \"field\": \"category\",\n \"equals\": \"Administrative\"\n },\n {\n \"field\": \"operationName\",\n \"equals\": \"Microsoft.Network/vpnGateways/delete\"\n },\n {\n \"field\": \"status\",\n \"containsAny\": [\n \"succeeded\"\n ]\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#31": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VPNGw_BandwidthUtil_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VPNG Bandwidth Utilization Alert\",\n \"description\": \"Policy to audit/deploy VPN Gateway Bandwidth Utilization Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Network\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"0\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT1M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"1\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"microsoft.network/vpngateways\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"microsoft.network/vpngateways\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"tunnelaveragebandwidth\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/microsoft.network/vpngateways/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].operator\",\n \"equals\": \"LessThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-tunnelaveragebandwidth-threshold-Override_'), field('tags._amba-tunnelaveragebandwidth-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-GatewayBandwidthAlert')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for VPN Gateway Bandwidth Utilization\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"tunnelaveragebandwidth\",\n \"metricNamespace\": \"microsoft.network/vpngateways\",\n \"metricName\": \"tunnelaveragebandwidth\",\n \"operator\": \"LessThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-tunnelaveragebandwidth-threshold-Override_'), field('tags._amba-tunnelaveragebandwidth-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#32": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VPNGw_BGPPeerStatus_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VPNG BGP Peer Status Alert\",\n \"description\": \"Policy to audit/deploy VPN Gateway BGP Peer Status Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Network\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"0\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT1M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"1\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"microsoft.network/vpngateways\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"microsoft.network/vpngateways\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"bgppeerstatus\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/microsoft.network/vpngateways/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Total\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].operator\",\n \"equals\": \"LessThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-bgppeerstatus-threshold-Override_'), field('tags._amba-bgppeerstatus-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-BGPPeerStatusAlert')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for VPN Gateway BGP peer status\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"bgppeerstatus\",\n \"metricNamespace\": \"microsoft.network/vpngateways\",\n \"metricName\": \"bgppeerstatus\",\n \"operator\": \"LessThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Total\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-bgppeerstatus-threshold-Override_'), field('tags._amba-bgppeerstatus-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#33": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VPNGw_Egress_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VPNG Egress Alert\",\n \"description\": \"Policy to audit/deploy VPN Gateway Egress Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Network\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"0\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"1\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"disabled\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"microsoft.network/vpngateways\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"microsoft.network/vpngateways\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"tunnelegressbytes\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/microsoft.network/vpngateways/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].operator\",\n \"equals\": \"LessThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-tunnelegressbytes-threshold-Override_'), field('tags._amba-tunnelegressbytes-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-TunnelEgressAlert')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for VPN Gateway tunnel egress bytes\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"tunnelegressbytes\",\n \"metricNamespace\": \"microsoft.network/vpngateways\",\n \"metricName\": \"tunnelegressbytes\",\n \"operator\": \"LessThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-tunnelegressbytes-threshold-Override_'), field('tags._amba-tunnelegressbytes-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#34": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VPNGw_TunnelEgressPacketDropCount_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VPNG Egress Packet Drop Count Alert\",\n \"description\": \"Policy to audit/deploy VPN Gateway Egress Packet Drop Count Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Network\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"3\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"microsoft.network/vpngateways\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"microsoft.network/vpngateways\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"TunnelEgressPacketDropCount\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/microsoft.network/vpngateways/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\n \"equals\": \"GreaterThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\n \"equals\": \"Medium\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": 2\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": 2\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-TunnelEgressPacketDropCountAlert')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for VPN Gateway tunnel TunnelEgressPacketDropCount\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"alertSensitivity\": \"Medium\",\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": 4,\n \"minFailingPeriodsToAlert\": 4\n },\n \"name\": \"TunnelEgressPacketDropCount\",\n \"metricNamespace\": \"microsoft.network/vpngateways\",\n \"metricName\": \"TunnelEgressPacketDropCount\",\n \"operator\": \"GreaterThan\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"DynamicThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#35": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VPNGw_TunnelEgressPacketDropMismatch_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VPNG Egress Packet Drop Mismatch Alert\",\n \"description\": \"Policy to audit/deploy VPN Gateway Egress Packet Drop Mismatch Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Network\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"3\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"microsoft.network/vpngateways\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"microsoft.network/vpngateways\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"TunnelEgressPacketDropTSMismatch\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/microsoft.network/vpngateways/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\n \"equals\": \"GreaterThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\n \"equals\": \"Medium\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": 2\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": 2\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-TunnelEgressPacketDropTSMismatchAlert')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for VPN Gateway tunnel TunnelEgressPacketDropTSMismatch\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"alertSensitivity\": \"Medium\",\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": 4,\n \"minFailingPeriodsToAlert\": 4\n },\n \"name\": \"TunnelEgressPacketDropTSMismatch\",\n \"metricNamespace\": \"microsoft.network/vpngateways\",\n \"metricName\": \"TunnelEgressPacketDropTSMismatch\",\n \"operator\": \"GreaterThan\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"DynamicThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#36": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VPNGw_Ingress_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VPNG Ingress Alert\",\n \"description\": \"Policy to audit/deploy VPN Gateway Ingress Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Network\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"0\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"1\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"disabled\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"microsoft.network/vpngateways\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"microsoft.network/vpngateways\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"tunnelingressbytes\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/microsoft.network/vpngateways/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].operator\",\n \"equals\": \"LessThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-tunnelingressbytes-threshold-Override_'), field('tags._amba-tunnelingressbytes-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-TunnelIngressAlert')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for VPN Gateway tunnel ingress bytes\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"tunnelingressbytes\",\n \"metricNamespace\": \"microsoft.network/vpngateways\",\n \"metricName\": \"tunnelingressbytes\",\n \"operator\": \"LessThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-tunnelingressbytes-threshold-Override_'), field('tags._amba-tunnelingressbytes-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#37": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VPNGw_TunnelIngressPacketDropCount_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VPNG Ingress Packet Drop Count Alert\",\n \"description\": \"Policy to audit/deploy VPN Gateway Ingress Packet Drop Count Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Network\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"3\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"microsoft.network/vpngateways\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"microsoft.network/vpngateways\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"TunnelIngressPacketDropCount\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/microsoft.network/vpngateways/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\n \"equals\": \"GreaterThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\n \"equals\": \"Medium\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": 2\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": 2\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-TunnelIngressPacketDropCountAlert')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for VPN Gateway tunnel TunnelIngressPacketDropCount\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"alertSensitivity\": \"Medium\",\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": 4,\n \"minFailingPeriodsToAlert\": 4\n },\n \"name\": \"TunnelIngressPacketDropCount\",\n \"metricNamespace\": \"microsoft.network/vpngateways\",\n \"metricName\": \"TunnelIngressPacketDropCount\",\n \"operator\": \"GreaterThan\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"DynamicThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#38": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VPNGw_TunnelIngressPacketDropMismatch_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VPNG Ingress Packet Drop Mismatch Alert\",\n \"description\": \"Policy to audit/deploy VPN Gateway Ingress Packet Drop Mismatch Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Network\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"3\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"microsoft.network/vpngateways\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"microsoft.network/vpngateways\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"TunnelIngressPacketDropTSMismatch\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/microsoft.network/vpngateways/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\n \"equals\": \"GreaterThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\n \"equals\": \"Medium\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": 2\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": 2\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-TunnelIngressPacketDropTSMismatchAlert')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for VPN Gateway tunnel TunnelIngressPacketDropTSMismatch\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"alertSensitivity\": \"Medium\",\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": 4,\n \"minFailingPeriodsToAlert\": 4\n },\n \"name\": \"TunnelIngressPacketDropTSMismatch\",\n \"metricNamespace\": \"microsoft.network/vpngateways\",\n \"metricName\": \"TunnelIngressPacketDropTSMismatch\",\n \"operator\": \"GreaterThan\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"DynamicThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#39": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_AG_ApplicationGatewayTotalTime_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy AGW ApplicationGatewayTotalTime Alert\",\n \"description\": \"Policy to audit/deploy Azure Application Gateway ApplicationGatewayTotalTime Alert\",\n \"metadata\": {\n \"version\": \"1.3.0\",\n \"Category\": \"Networking\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT1M\"\n },\n \"alertSensitivity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert Sensitivity\",\n \"description\": \"Alert Sensitivity for the alert\"\n },\n \"allowedValues\": [\n \"Low\",\n \"Medium\",\n \"High\"\n ],\n \"defaultValue\": \"Medium\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/applicationgateways\"\n },\n {\n \"field\": \"Microsoft.Network/applicationgateways/sku.name\",\n \"In\": [\n \"Standard_v2\",\n \"WAF_v2\"\n ]\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Network/applicationgateways\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"ApplicationGatewayTotalTime\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/applicationgateways/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\n \"equals\": \"GreaterThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\n \"equals\": \"[[parameters('alertSensitivity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": 2\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": 2\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"alertSensitivity\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-agApplicationGatewayTotalTime')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for App Gateway ApplicationGatewayTotalTime\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"ApplicationGatewayTotalTime\",\n \"metricNamespace\": \"Microsoft.Network/applicationgateways\",\n \"metricName\": \"ApplicationGatewayTotalTime\",\n \"operator\": \"GreaterThan\",\n \"alertSensitivity\": \"[[parameters('alertSensitivity')]\",\n \"failingPeriods\": {\n \"minFailingPeriodsToAlert\": 2,\n \"numberOfEvaluationPeriods\": 2\n },\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"DynamicThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"alertSensitivity\": {\n \"value\": \"[[parameters('alertSensitivity')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"alertSensitivity\": {\n \"value\": \"[[parameters('alertSensitivity')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#4": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_ERCIR_BgpAvailability_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy ExpressRoute Circuits Bgp Availability Alert\",\n \"description\": \"Policy to audit/deploy ExpressRoute Circuits Bgp Availability Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Network\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"0\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT1M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"90\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/expressRouteCircuits\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Network/expressRouteCircuits\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"BgpAvailability\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/expressRouteCircuits/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\n \"equals\": \"LessThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-BgpAvailability-threshold-Override_'), field('tags._amba-BgpAvailability-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-BgpAvailability')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for ExpressRoute Circuit Bgp Availability\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"BgpAvailability\",\n \"metricNamespace\": \"Microsoft.Network/expressRouteCircuits\",\n \"metricName\": \"BgpAvailability\",\n \"operator\": \"LessThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-BgpAvailability-threshold-Override_'), field('tags._amba-BgpAvailability-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#40": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_AG_BackendLastByteResponseTime_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy AGW BackendLastByteResponseTime Alert\",\n \"description\": \"Policy to audit/deploy Azure Application Gateway BackendLastByteResponseTime Alert\",\n \"metadata\": {\n \"version\": \"1.3.0\",\n \"Category\": \"Networking\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT1M\"\n },\n \"alertSensitivity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert Sensitivity\",\n \"description\": \"Alert Sensitivity for the alert\"\n },\n \"allowedValues\": [\n \"Low\",\n \"Medium\",\n \"High\"\n ],\n \"defaultValue\": \"Medium\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/applicationgateways\"\n },\n {\n \"field\": \"Microsoft.Network/applicationgateways/sku.name\",\n \"In\": [\n \"Standard_v2\",\n \"WAF_v2\"\n ]\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Network/applicationgateways\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"BackendLastByteResponseTime\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/applicationgateways/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\n \"equals\": \"GreaterThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\n \"equals\": \"[[parameters('alertSensitivity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": 2\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": 2\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"alertSensitivity\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-agBackendLastByteResponseTime')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for App Gateway BackendLastByteResponseTime\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"BackendLastByteResponseTime\",\n \"metricNamespace\": \"Microsoft.Network/applicationgateways\",\n \"metricName\": \"BackendLastByteResponseTime\",\n \"operator\": \"GreaterThan\",\n \"alertSensitivity\": \"[[parameters('alertSensitivity')]\",\n \"failingPeriods\": {\n \"minFailingPeriodsToAlert\": 2,\n \"numberOfEvaluationPeriods\": 2\n },\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"DynamicThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"alertSensitivity\": {\n \"value\": \"[[parameters('alertSensitivity')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"alertSensitivity\": {\n \"value\": \"[[parameters('alertSensitivity')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#41": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_AG_CapacityUnits_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy AGW Capacity Units Alert\",\n \"description\": \"Policy to audit/deploy Azure Application Gateway CapacityUnits Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"Category\": \"Networking\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT1M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"75\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/applicationgateways\"\n },\n {\n \"field\": \"Microsoft.Network/applicationgateways/sku.name\",\n \"In\": [\n \"Standard_v2\",\n \"WAF_v2\"\n ]\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Network/applicationgateways\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"CapacityUnits\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/applicationgateways/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\n \"equals\": \"GreaterThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-CapacityUnits-threshold-Override_'), field('tags._amba-CapacityUnits-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-agCapacityUnits')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for App Gateway Capacity Units\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"CapacityUnits\",\n \"metricNamespace\": \"Microsoft.Network/applicationgateways\",\n \"metricName\": \"CapacityUnits\",\n \"operator\": \"GreaterThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-CapacityUnits-threshold-Override_'), field('tags._amba-CapacityUnits-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#42": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_AG_ComputeUnits_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy AGW Compute Units Alert\",\n \"description\": \"Policy to audit/deploy Azure Application Gateway ComputeUnits Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"Category\": \"Networking\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT1M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"75\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/applicationgateways\"\n },\n {\n \"field\": \"Microsoft.Network/applicationgateways/sku.name\",\n \"In\": [\n \"Standard_v2\",\n \"WAF_v2\"\n ]\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Network/applicationgateways\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"ComputeUnits\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/applicationgateways/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\n \"equals\": \"GreaterThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-ComputeUnits-threshold-Override_'), field('tags._amba-ComputeUnits-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-agComputeUnits')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for App Gateway Compute Units\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"ComputeUnits\",\n \"metricNamespace\": \"Microsoft.Network/applicationgateways\",\n \"metricName\": \"ComputeUnits\",\n \"operator\": \"GreaterThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-ComputeUnits-threshold-Override_'), field('tags._amba-ComputeUnits-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#43": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_AG_CPUUtilization_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy AGW CPU Utilization Alert\",\n \"description\": \"Policy to audit/deploy Azure Application Gateway CPU Utilization Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"Category\": \"Networking\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT1M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"80\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/applicationgateways\"\n },\n {\n \"field\": \"Microsoft.Network/applicationgateways/sku.name\",\n \"notIn\": [\n \"Standard_v2\",\n \"WAF_v2\"\n ]\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Network/applicationgateways\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"CpuUtilization\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/applicationgateways/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\n \"equals\": \"GreaterThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-CpuUtilization-threshold-Override_'), field('tags._amba-CpuUtilization-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-agCpuUtilization')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for App Gateway CPU Utilization\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"CpuUtilization\",\n \"metricNamespace\": \"Microsoft.Network/applicationgateways\",\n \"metricName\": \"CpuUtilization\",\n \"operator\": \"GreaterThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-CpuUtilization-threshold-Override_'), field('tags._amba-CpuUtilization-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#44": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_AG_FailedRequests_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy AGW FailedRequests Alert\",\n \"description\": \"Policy to audit/deploy Azure Application Gateway FailedRequests Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"Category\": \"Networking\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT1M\"\n },\n \"alertSensitivity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert Sensitivity\",\n \"description\": \"Alert Sensitivity for the alert\"\n },\n \"allowedValues\": [\n \"Low\",\n \"Medium\",\n \"High\"\n ],\n \"defaultValue\": \"Medium\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/applicationgateways\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Network/applicationgateways\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"FailedRequests\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/applicationgateways/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Total\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\n \"equals\": \"GreaterThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\n \"equals\": \"[[parameters('alertSensitivity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": 2\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": 2\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"alertSensitivity\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-agFailedRequests')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for App Gateway FailedRequests\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"FailedRequests\",\n \"metricNamespace\": \"Microsoft.Network/applicationgateways\",\n \"metricName\": \"FailedRequests\",\n \"operator\": \"GreaterThan\",\n \"alertSensitivity\": \"[[parameters('alertSensitivity')]\",\n \"failingPeriods\": {\n \"minFailingPeriodsToAlert\": 2,\n \"numberOfEvaluationPeriods\": 2\n },\n \"timeAggregation\": \"Total\",\n \"criterionType\": \"DynamicThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"alertSensitivity\": {\n \"value\": \"[[parameters('alertSensitivity')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"alertSensitivity\": {\n \"value\": \"[[parameters('alertSensitivity')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#45": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_AG_ResponseStatus_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy AGW ResponseStatus Alert\",\n \"description\": \"Policy to audit/deploy Azure Application Gateway ResponseStatus Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"Category\": \"Networking\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT1M\"\n },\n \"alertSensitivity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert Sensitivity\",\n \"description\": \"Alert Sensitivity for the alert\"\n },\n \"allowedValues\": [\n \"Low\",\n \"Medium\",\n \"High\"\n ],\n \"defaultValue\": \"Medium\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/applicationgateways\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Network/applicationgateways\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"ResponseStatus\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/applicationgateways/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Total\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\n \"equals\": \"GreaterThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\n \"equals\": \"[[parameters('alertSensitivity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": 2\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": 2\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"alertSensitivity\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-agResponseStatus')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for App Gateway ResponseStatus\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"ResponseStatus\",\n \"metricNamespace\": \"Microsoft.Network/applicationgateways\",\n \"metricName\": \"ResponseStatus\",\n \"operator\": \"GreaterThan\",\n \"alertSensitivity\": \"[[parameters('alertSensitivity')]\",\n \"failingPeriods\": {\n \"minFailingPeriodsToAlert\": 2,\n \"numberOfEvaluationPeriods\": 2\n },\n \"timeAggregation\": \"Total\",\n \"dimensions\": [\n {\n \"name\": \"HttpStatusGroup\",\n \"operator\": \"Include\",\n \"values\": [\n \"4xx\",\n \"5xx\"\n ]\n }\n ],\n \"criterionType\": \"DynamicThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"alertSensitivity\": {\n \"value\": \"[[parameters('alertSensitivity')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"alertSensitivity\": {\n \"value\": \"[[parameters('alertSensitivity')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#46": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_AG_UnhealthyHostCount_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy AGW Unhealthy Host Count Alert\",\n \"description\": \"Policy to audit/deploy Azure Application Gateway Unhealthy Host Count Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"Category\": \"Networking\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT1M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"20\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/applicationgateways\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Network/applicationgateways\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"UnhealthyHostCount\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/applicationgateways/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\n \"equals\": \"GreaterThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-UnhealthyHostCount-threshold-Override_'), field('tags._amba-UnhealthyHostCount-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-agUnhealthyHostCount')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for App Gateway Unhealthy Host Count\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"CpuUtilization\",\n \"metricNamespace\": \"Microsoft.Network/applicationgateways\",\n \"metricName\": \"UnhealthyHostCount\",\n \"operator\": \"GreaterThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-UnhealthyHostCount-threshold-Override_'), field('tags._amba-UnhealthyHostCount-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#47": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_TM_EndpointHealth_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Traffic Manager Endpoint Health Alert\",\n \"description\": \"Policy to audit/deploy FTraffic Manager Endpoint Health Health Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"Category\": \"Networking\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"0.9\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/trafficmanagerprofiles\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Network/trafficmanagerprofiles\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"ProbeAgentCurrentEndpointStateByProfileResourceId\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/trafficmanagerprofiles/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\n \"equals\": \"LessThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-EndpointHealth-threshold-Override_'), field('tags._amba-EndpointHealth-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-EndpointHealthAlert')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for Traffic Manager Endpoint Health\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"EndpointHealth\",\n \"metricNamespace\": \"Microsoft.Network/trafficmanagerprofiles\",\n \"metricName\": \"ProbeAgentCurrentEndpointStateByProfileResourceId\",\n \"operator\": \"LessThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"StaticThresholdCriterion\",\n \"dimensions\": [\n {\n \"name\": \"EndpointName\",\n \"operator\": \"Include\",\n \"values\": [\n \"*\"\n ]\n }\n ]\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-EndpointHealth-threshold-Override_'), field('tags._amba-EndpointHealth-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#48": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_FD_BackendHealth_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Frontdoor Backend Health Percentage Alert\",\n \"description\": \"Policy to audit/deploy FrontDoor Backend Health Percentage Alert\",\n \"metadata\": {\n \"version\": \"1.1.1\",\n \"category\": \"Networking\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"90\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"disabled\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/frontdoors\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Network/frontdoors\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"BackendHealthPercentage\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/frontdoors/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\n \"equals\": \"LessThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-BackendHealthPercentage-threshold-Override_'), field('tags._amba-BackendHealthPercentage-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-BackendHealthPercentage')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for Frontdoor Backend Health Percentage\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"BackendHealthPercentage\",\n \"metricNamespace\": \"Microsoft.Network/frontdoors\",\n \"metricName\": \"BackendHealthPercentage\",\n \"operator\": \"LessThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-BackendHealthPercentage-threshold-Override_'), field('tags._amba-BackendHealthPercentage-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#49": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_FD_BackendRequestLatency_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Frontdoor Backend Request Latency Alert\",\n \"description\": \"Policy to audit/deploy Frontdoor Backend Request Latency Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Networking\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"disabled\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/frontdoors\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Network/frontdoors\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"BackendRequestLatency\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/frontdoors/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\n \"equals\": \"GreaterThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\n \"equals\": \"Medium\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": 2\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": 2\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-BackendRequestLatencyAlert')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for Frontdoor BackendRequestLatency\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"alertSensitivity\": \"Medium\",\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": 2,\n \"minFailingPeriodsToAlert\": 2\n },\n \"name\": \"ServiceApiResult\",\n \"metricNamespace\": \"Microsoft.Network/frontdoors\",\n \"metricName\": \"BackendRequestLatency\",\n \"operator\": \"GreaterThan\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"DynamicThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#5": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_ERCIR_QosDropBitsInPerSecond_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy ExpressRoute Circuits QosDropBitsInPerSecond Alert\",\n \"description\": \"Policy to audit/deploy ExpressRoute Circuits QosDropBitsInPerSecond Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Network\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/expressRouteCircuits\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Network/expressRouteCircuits\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"QosDropBitsInPerSecond\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/expressRouteCircuits/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\n \"equals\": \"GreaterThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\n \"equals\": \"Medium\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": 2\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": 2\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-QosDropBitsInPerSecond')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for ExpressRoute Circuit QosDropBitsInPerSecond\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"alertSensitivity\": \"Medium\",\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": 4,\n \"minFailingPeriodsToAlert\": 4\n },\n \"name\": \"QosDropBitsInPerSecond\",\n \"metricNamespace\": \"Microsoft.Network/expressRouteCircuits\",\n \"metricName\": \"QosDropBitsInPerSecond\",\n \"operator\": \"GreaterThan\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"DynamicThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#50": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_FrontDoorCDN_OriginHealthPercentage_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy FrontDoor CDN Profile Origin Health Percentage Alert\",\n \"description\": \"Policy to audit/deploy FrontDoor Origin Health Percentage Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"Category\": \"Networking\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"90\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Cdn/profiles\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Cdn/profiles\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"OriginHealthPercentage\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Cdn/profiles/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\n \"equals\": \"LessThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-OriginHealthPercentage-threshold-override_'), field('tags._amba-OriginHealthPercentage-threshold-override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-OriginHealthPercentage')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for Frontdoor Origin Health Percentage\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"OriginHealthPercentage\",\n \"metricNamespace\": \"Microsoft.Cdn/profiles\",\n \"metricName\": \"OriginHealthPercentage\",\n \"operator\": \"LessThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-OriginHealthPercentage-threshold-override_'), field('tags._amba-OriginHealthPercentage-threshold-override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#51": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_FrontDoorCDN_OriginLatency_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy FrontDoor CDN Profile Origin Latency Alert\",\n \"description\": \"Policy to audit/deploy FrontDoor CDN Profile Origin Latency Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Networking\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"disabled\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Cdn/profiles\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Cdn/profiles\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"OriginLatency\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Cdn/profiles/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\n \"equals\": \"GreaterThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\n \"equals\": \"Medium\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": 2\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": 2\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-OriginLatencyAlert')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for Frontdoor CDN Origin Latency\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"alertSensitivity\": \"Medium\",\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": 2,\n \"minFailingPeriodsToAlert\": 2\n },\n \"name\": \"ServiceApiResult\",\n \"metricNamespace\": \"Microsoft.Cdn/profiles\",\n \"metricName\": \"OriginLatency\",\n \"operator\": \"GreaterThan\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"DynamicThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#52": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_FrontDoorCDN_Percentage4XX_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy FrontDoor CDN Profile Percentage4XX Alert\",\n \"description\": \"Policy to audit/deploy FrontDoor CDN Profile Percentage4XX Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Networking\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Cdn/profiles\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Cdn/profiles\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"Percentage4XX\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Cdn/profiles/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\n \"equals\": \"GreaterThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\n \"equals\": \"Medium\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": 2\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": 2\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-Percentage4XXAlert')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for Frontdoor CDN Origin Latency\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"alertSensitivity\": \"Medium\",\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": 2,\n \"minFailingPeriodsToAlert\": 2\n },\n \"name\": \"ServiceApiResult\",\n \"metricNamespace\": \"Microsoft.Cdn/profiles\",\n \"metricName\": \"Percentage4XX\",\n \"operator\": \"GreaterThan\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"DynamicThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#53": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_FrontDoorCDN_Percentage5XX_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy FrontDoor CDN Profile Percentage5XX Alert\",\n \"description\": \"Policy to audit/deploy FrontDoor CDN Profile Percentage5XX Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Networking\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Cdn/profiles\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Cdn/profiles\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"Percentage5XX\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Cdn/profiles/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\n \"equals\": \"GreaterThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\n \"equals\": \"Medium\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": 2\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": 2\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-Percentage5XXAlert')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for Frontdoor CDN Origin Latency\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"alertSensitivity\": \"Medium\",\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": 2,\n \"minFailingPeriodsToAlert\": 2\n },\n \"name\": \"ServiceApiResult\",\n \"metricNamespace\": \"Microsoft.Cdn/profiles\",\n \"metricName\": \"Percentage5XX\",\n \"operator\": \"GreaterThan\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"DynamicThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#54": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_ALB_DataPathAvailability_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy ALB Data Path Availability Alert\",\n \"description\": \"Policy to audit/deploy Azure Load Balancer Data Path Availability Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"Category\": \"Networking\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"0\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT1M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"90\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/loadBalancers\"\n },\n {\n \"field\": \"Microsoft.Network/loadBalancers/sku.name\",\n \"in\": [\n \"Standard\",\n \"Gateway\"\n ]\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Network/loadBalancers\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"VipAvailability\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/loadBalancers/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\n \"equals\": \"LessThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-VipAvailability-threshold-Override_'), field('tags._amba-VipAvailability-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-ALBDataPathAvailability')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for ALB Data Path Availability\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"VipAvailability\",\n \"metricNamespace\": \"Microsoft.Network/loadBalancers\",\n \"metricName\": \"VipAvailability\",\n \"operator\": \"LessThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-VipAvailability-threshold-Override_'), field('tags._amba-VipAvailability-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#55": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_ALB_GlobalBackendAvailability_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy ALB Global Backend Availability Alert\",\n \"description\": \"Policy to audit/deploy Azure Load Balancer Global Backend Availability Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"Category\": \"Networking\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"0\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT1M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"90\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/loadBalancers\"\n },\n {\n \"field\": \"Microsoft.Network/loadBalancers/sku.tier\",\n \"equals\": \"Global\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Network/loadBalancers\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"GlobalBackendAvailability\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/loadBalancers/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\n \"equals\": \"LessThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-GlobalBackendAvailability-threshold-Override_'), field('tags._amba-GlobalBackendAvailability-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-ALBGlobalBackendAvailability')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for Global Backend Availability\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"GlobalBackendAvailability\",\n \"metricNamespace\": \"Microsoft.Network/loadBalancers\",\n \"metricName\": \"GlobalBackendAvailability\",\n \"operator\": \"LessThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-GlobalBackendAvailability-threshold-Override_'), field('tags._amba-GlobalBackendAvailability-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#56": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_ALB_HealthProbeStatus_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy ALB Health Probe Status Alert\",\n \"description\": \"Policy to audit/deploy Azure Load Balancer Health Probe Status Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"Category\": \"Networking\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT1M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"90\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/loadBalancers\"\n },\n {\n \"field\": \"Microsoft.Network/loadBalancers/sku.name\",\n \"in\": [\n \"Standard\",\n \"Gateway\"\n ]\n },\n {\n \"field\": \"Microsoft.Network/loadBalancers/sku.tier\",\n \"equals\": \"Regional\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Network/loadBalancers\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"DipAvailability\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/loadBalancers/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\n \"equals\": \"LessThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-DipAvailability-threshold-Override_'), field('tags._amba-DipAvailability-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-ALBHealthProbeStatus')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for ALB Health Probe Status\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"DipAvailability\",\n \"metricNamespace\": \"Microsoft.Network/loadBalancers\",\n \"metricName\": \"DipAvailability\",\n \"operator\": \"LessThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-DipAvailability-threshold-Override_'), field('tags._amba-DipAvailability-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#57": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_ALB_UsedSNATPorts_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy ALB Used SNAT Ports Alert\",\n \"description\": \"Policy to audit/deploy Azure Load Balancer Used SNAT Ports Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"Category\": \"Networking\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"1\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT1M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"900\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/loadBalancers\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Network/loadBalancers\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"UsedSNATPorts\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/loadBalancers/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\n \"equals\": \"GreaterThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-UsedSNATPorts-threshold-Override_'), field('tags._amba-UsedSNATPorts-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-ALBUsedSNATPorts')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for ALB Used SNAT Ports\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"UsedSNATPorts\",\n \"metricNamespace\": \"Microsoft.Network/loadBalancers\",\n \"metricName\": \"UsedSNATPorts\",\n \"operator\": \"GreaterThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-UsedSNATPorts-threshold-Override_'), field('tags._amba-UsedSNATPorts-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#58": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_PublicIp_BytesInDDoSAttack_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy PIP Bytes in DDoS Attack Alert\",\n \"description\": \"Policy to audit/deploy PIP Bytes in DDoS Attack Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Network\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"4\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"8000000\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"disabled\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/publicIPAddresses\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Network/publicIPAddresses\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"bytesinddos\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/publicIPAddresses/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Maximum\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\n \"equals\": \"GreaterThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-bytesinddos-threshold-Override_'), field('tags._amba-bytesinddos-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-BytesInDDOSAlert')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for Public IP Address Bytes IN DDOS\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"bytesinddos\",\n \"metricNamespace\": \"Microsoft.Network/publicIPAddresses\",\n \"metricName\": \"bytesinddos\",\n \"operator\": \"GreaterThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Maximum\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-bytesinddos-threshold-Override_'), field('tags._amba-bytesinddos-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#59": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_PublicIp_DDoSAttack_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy PIP DDoS Attack Alert\",\n \"description\": \"Policy to audit/deploy PIP DDoS Attack Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Network\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"1\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"0\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/publicIPAddresses\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Network/publicIPAddresses\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"ifunderddosattack\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/publicIPAddresses/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Maximum\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\n \"equals\": \"GreaterThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-ifunderddosattack-threshold-Override_'), field('tags._amba-ifunderddosattack-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-DDOS_Attack')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for Public IP Address Under Attack\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"ifunderddosattack\",\n \"metricNamespace\": \"Microsoft.Network/publicIPAddresses\",\n \"metricName\": \"ifunderddosattack\",\n \"operator\": \"GreaterThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Maximum\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-ifunderddosattack-threshold-Override_'), field('tags._amba-ifunderddosattack-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#6": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_ERCIR_QosDropBitsOutPerSecond_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy ExpressRoute Circuits QosDropBitsOutPerSecond Alert\",\n \"description\": \"Policy to audit/deploy ExpressRoute Circuits QosDropBitsOutPerSecond Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Network\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/expressRouteCircuits\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Network/expressRouteCircuits\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"QosDropBitsOutPerSecond\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/expressRouteCircuits/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\n \"equals\": \"GreaterThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\n \"equals\": \"Medium\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": 2\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": 2\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-QosDropBitsOutPerSecond')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for ExpressRoute Circuit QosDropBitsOutPerSecond\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"alertSensitivity\": \"Medium\",\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": 4,\n \"minFailingPeriodsToAlert\": 4\n },\n \"name\": \"QosDropBitsOutPerSecond\",\n \"metricNamespace\": \"Microsoft.Network/expressRouteCircuits\",\n \"metricName\": \"QosDropBitsOutPerSecond\",\n \"operator\": \"GreaterThan\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"DynamicThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#60": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_PublicIp_PacketsInDDoSAttack_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy PIP Packets in DDoS Attack Alert\",\n \"description\": \"Policy to audit/deploy PIP Packets in DDoS Attack Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Network\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"4\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"40000\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"disabled\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/publicIPAddresses\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Network/publicIPAddresses\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"PacketsInDDoS\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/publicIPAddresses/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Total\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].operator\",\n \"equals\": \"GreaterThanOrEqual\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-PacketsInDDoS-threshold-Override_'), field('tags._amba-PacketsInDDoS-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-PacketsInDDosAlert')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for Public IP Address Packets IN DDOS\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"PacketsInDDoS\",\n \"metricNamespace\": \"Microsoft.Network/publicIPAddresses\",\n \"metricName\": \"PacketsInDDoS\",\n \"operator\": \"GreaterThanOrEqual\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Total\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-PacketsInDDoS-threshold-Override_'), field('tags._amba-PacketsInDDoS-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#61": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_PublicIp_VIPAvailability_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy PIP VIP Availability Alert\",\n \"description\": \"Policy to audit/deploy PIP VIP Availability Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Network\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"1\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT1M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"90\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/publicIPAddresses\"\n },\n {\n \"field\": \"Microsoft.Network/publicIPAddresses/sku.name\",\n \"equals\": \"Standard\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Network/publicIPAddresses\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"VipAvailability\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/publicIPAddresses/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\n \"equals\": \"LessThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-VipAvailability-threshold-Override_'), field('tags._amba-VipAvailability-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-VIPAvailabityAlert')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for Public IP Address VIP Availability\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"VipAvailability\",\n \"metricNamespace\": \"Microsoft.Network/publicIPAddresses\",\n \"metricName\": \"VipAvailability\",\n \"operator\": \"LessThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-VipAvailability-threshold-Override_'), field('tags._amba-VipAvailability-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#62": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_VNET_DDoSAttack_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy VNet DDoS Attack Alert\",\n \"description\": \"Policy to audit/deploy Virtual Network DDoS Attack Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Network\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"1\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT1M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"0\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/virtualNetworks\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Network/virtualNetworks\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"ifunderddosattack\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/virtualNetworks/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Maximum\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\n \"equals\": \"GreaterThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-ifunderddosattack-threshold-Override_'), field('tags._amba-ifunderddosattack-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-DDOSAttackAlert')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for VNet DDOS Attack\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"ifunderddosattack\",\n \"metricNamespace\": \"Microsoft.Network/virtualNetworks\",\n \"metricName\": \"ifunderddosattack\",\n \"operator\": \"GreaterThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Maximum\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-ifunderddosattack-threshold-Override_'), field('tags._amba-ifunderddosattack-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#63": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_activitylog_RouteTable_Update\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Activity Log Route Table Update Alert\",\n \"description\": \"Policy to Deploy Activity Log Route Table Update Alert\",\n \"metadata\": {\n \"version\": \"1.1.0\",\n \"category\": \"Network\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/routeTables\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/activityLogAlerts\",\n \"name\": \"ActivityUDRUpdate\",\n \"existenceScope\": \"resourcegroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"count\": {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*]\",\n \"where\": {\n \"anyOf\": [\n {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].field\",\n \"equals\": \"category\"\n },\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].equals\",\n \"equals\": \"Administrative\"\n }\n ]\n },\n {\n \"allOf\": [\n {\n \"field\": \"microsoft.insights/activityLogAlerts/condition.allOf[*].field\",\n \"equals\": \"operationName\"\n },\n {\n \"field\": \"microsoft.insights/activityLogAlerts/condition.allOf[*].equals\",\n \"equals\": \"Microsoft.Network/routeTables/routes/write\"\n }\n ]\n }\n ]\n }\n },\n \"equals\": 2\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"enabled\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"ActivityUDRUpdate\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"microsoft.insights/activityLogAlerts\",\n \"apiVersion\": \"2020-10-01\",\n \"name\": \"ActivityUDRUpdate\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Activity Log Route table update\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().id]\"\n ],\n \"condition\": {\n \"allOf\": [\n {\n \"field\": \"category\",\n \"equals\": \"Administrative\"\n },\n {\n \"field\": \"operationName\",\n \"equals\": \"Microsoft.Network/routeTables/routes/write\"\n },\n {\n \"field\": \"status\",\n \"containsAny\": [\n \"succeeded\"\n ]\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#64": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_activitylog_NSG_Delete\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Activity Log NSG Delete Alert\",\n \"description\": \"Policy to Deploy Activity Log NSG Delete Alert\",\n \"metadata\": {\n \"version\": \"1.1.0\",\n \"category\": \"Network\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"Project\": \"amba-monitoring\"\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/networkSecurityGroups\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/activityLogAlerts\",\n \"name\": \"ActivityNSGDelete\",\n \"existenceScope\": \"resourcegroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"count\": {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*]\",\n \"where\": {\n \"anyOf\": [\n {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].field\",\n \"equals\": \"category\"\n },\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].equals\",\n \"equals\": \"Administrative\"\n }\n ]\n },\n {\n \"allOf\": [\n {\n \"field\": \"microsoft.insights/activityLogAlerts/condition.allOf[*].field\",\n \"equals\": \"operationName\"\n },\n {\n \"field\": \"microsoft.insights/activityLogAlerts/condition.allOf[*].equals\",\n \"equals\": \"Microsoft.Network/networkSecurityGroups/delete\"\n }\n ]\n }\n ]\n }\n },\n \"equals\": 2\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"enabled\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"ActivityNSGDelete\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"microsoft.insights/activityLogAlerts\",\n \"apiVersion\": \"2020-10-01\",\n \"name\": \"ActivityNSGDelete\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Activity Log NSG Delete\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().id]\"\n ],\n \"condition\": {\n \"allOf\": [\n {\n \"field\": \"category\",\n \"equals\": \"Administrative\"\n },\n {\n \"field\": \"operationName\",\n \"equals\": \"Microsoft.Network/networkSecurityGroups/delete\"\n },\n {\n \"field\": \"status\",\n \"containsAny\": [\n \"succeeded\"\n ]\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#65": { + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "name": "Alerting-Connectivity", + "properties": { + "displayName": "Deploy Azure Monitor Baseline Alerts for Connectivity", + "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Network components such as Azure Firewalls, ExpressRoute, VPN, and Private DNS Zones.", + "metadata": { + "version": "1.1.1", + "category": "Monitoring", + "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", + "alzCloudEnvironments": [ + "AzureCloud" + ], + "_deployed_by_amba": true + }, + "parameters": { + "ALZMonitorResourceGroupName": { + "type": "String", + "defaultValue": "ALZ-Monitoring-RG", + "metadata": { + "displayName": "ALZ Monitor Resource Group Name", + "description": "Name of the resource group where the ALZ Monitor resources will be deployed" + } + }, + "ALZMonitorResourceGroupTags": { + "type": "Object", + "defaultValue": { + "_deployed_by_alz_monitor": true + }, + "metadata": { + "displayName": "ALZ Monitor Resource Group Tags", + "description": "Tags to be applied to the resource group where the ALZ Monitor resources will be deployed" + } + }, + "ALZMonitorResourceGroupLocation": { + "type": "String", + "defaultValue": "centralus", + "metadata": { + "displayName": "ALZ Monitor Resource Group Location", + "description": "Location of the resource group where the ALZ Monitor resources will be deployed" + } + }, + "ALZMonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": "MonitorDisableTagName" + }, + "ALZMonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] + }, + "ERCIRQoSDropBitsinPerSecAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "ERC IRQoS Drop Bits in Per Sec Alert Severity", + "description": "Severity of the alert" + } + }, + "ERCIRQoSDropBitsinPerSecWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "ERC IRQoS Drop Bits in Per Sec Window Size", + "description": "Window size for the alert" + } + }, + "ERCIRQoSDropBitsinPerSecEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "ERC IRQoS Drop Bits in Per Sec Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "ERCIRQoSDropBitsinPerSecPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "ERC IRQoS Drop Bits in Per Sec Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "ERCIRQoSDropBitsinPerSecAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "ERC IRQoS Drop Bits in Per Sec Alert State", + "description": "Alert state for the alert" + } + }, + "ERCIRQoSDropBitsoutPerSecAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "ERC IRQoS Drop Bits out Per Sec Alert Severity", + "description": "Severity of the alert" + } + }, + "ERCIRQoSDropBitsoutPerSecWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "ERC IRQoS Drop Bits out Per Sec Window Size", + "description": "Window size for the alert" + } + }, + "ERCIRQoSDropBitsoutPerSecEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "ERC IRQoS Drop Bits out Per Sec Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "ERCIRQoSDropBitsoutPerSecPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "ERC IRQoS Drop Bits out Per Sec Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "ERCIRQoSDropBitsoutPerSecAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "ERC IRQoS Drop Bits out Per Sec Alert State", + "description": "Alert state for the alert" + } + }, + "VPNGwBGPPeerStatusAlertSeverity": { + "type": "String", + "defaultValue": "3", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "VPN Gw BGP Peer Status Alert Severity", + "description": "Severity of the alert" + } + }, + "VPNGwBGPPeerStatusWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "VPN Gw BGP Peer Status Window Size", + "description": "Window size for the alert" + } + }, + "VPNGwBGPPeerStatusEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "VPN Gw BGP Peer Status Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VPNGwBGPPeerStatusPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "VPN Gw BGP Peer Status Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "VPNGwBGPPeerStatusAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VPN Gw BGP Peer Status Alert State", + "description": "Alert state for the alert" + } + }, + "VPNGwBGPPeerStatusThreshold": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VPN Gw BGP Peer Status Threshold", + "description": "Threshold for the alert" + } + }, + "VnetGwERCpuUtilAlertSeverity": { + "type": "String", + "defaultValue": "3", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "Vnet Gw ER Cpu Util Alert Severity", + "description": "Severity of the alert" + } + }, + "VnetGwERCpuUtilWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "Vnet Gw ER Cpu Util Window Size", + "description": "Window size for the alert" + } + }, + "VnetGwERCpuUtilEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "Vnet Gw ER Cpu Util Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VnetGwERCpuUtilPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Vnet Gw ER Cpu Util Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "VnetGwERCpuUtilAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Vnet Gw ER Cpu Util Alert State", + "description": "Alert state for the alert" + } + }, + "VnetGwERCpuUtilThreshold": { + "type": "string", + "defaultValue": "80", + "metadata": { + "displayName": "Vnet Gw ER Cpu Util Threshold", + "description": "Threshold for the alert" + } + }, + "VnetGwTunnelBWAlertSeverity": { + "type": "String", + "defaultValue": "0", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "Vnet Gw Tunnel BW Alert Severity", + "description": "Severity of the alert" + } + }, + "VnetGwTunnelBWWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "Vnet Gw Tunnel BW Window Size", + "description": "Window size for the alert" + } + }, + "VnetGwTunnelBWEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "Vnet Gw Tunnel BW Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VnetGwTunnelBWPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Vnet Gw Tunnel BW Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "VnetGwTunnelBWAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Vnet Gw Tunnel BW Alert State", + "description": "Alert state for the alert" + } + }, + "VnetGwTunnelBWThreshold": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "Vnet Gw Tunnel BW Threshold", + "description": "Threshold for the alert" + } + }, + "VnetGwTunnelEgressAlertSeverity": { + "type": "String", + "defaultValue": "0", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "Vnet Gw Tunnel Egress Alert Severity", + "description": "Severity of the alert" + } + }, + "VnetGwTunnelEgressWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "Vnet Gw Tunnel Egress Window Size", + "description": "Window size for the alert" + } + }, + "VnetGwTunnelEgressEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "Vnet Gw Tunnel Egress Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VnetGwTunnelEgressPolicyEffect": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Vnet Gw Tunnel Egress Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "VnetGwTunnelEgressAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Vnet Gw Tunnel Egress Alert State", + "description": "Alert state for the alert" + } + }, + "VnetGwTunnelEgressThreshold": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "Vnet Gw Tunnel Egress Threshold", + "description": "Threshold for the alert" + } + }, + "VnetGwTunnelIngressAlertSeverity": { + "type": "String", + "defaultValue": "0", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "Vnet Gw Tunnel Ingress Alert Severity", + "description": "Severity of the alert" + } + }, + "VnetGwTunnelIngressWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "Vnet Gw Tunnel Ingress Window Size", + "description": "Window size for the alert" + } + }, + "VnetGwTunnelIngressEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "Vnet Gw Tunnel Ingress Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VnetGwTunnelIngressPolicyEffect": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Vnet Gw Tunnel Ingress Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "VnetGwTunnelIngressAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Vnet Gw Tunnel Ingress Alert State", + "description": "Alert state for the alert" + } + }, + "VnetGwTunnelIngressThreshold": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "Vnet Gw Tunnel Ingress Threshold", + "description": "Threshold for the alert" + } + }, + "VPNGWBandWidthUtilAlertSeverity": { + "type": "String", + "defaultValue": "0", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "VPN GW Band Width Util Alert Severity", + "description": "Severity of the alert" + } + }, + "VPNGWBandWidthUtilWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "VPN GW Band Width Util Window Size", + "description": "Window size for the alert" + } + }, + "VPNGWBandWidthUtilEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "VPN GW Band Width Util Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VPNGWBandWidthUtilPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "VPN GW Band Width Util Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "VPNGWBandWidthUtilAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VPN GW Band Width Util Alert State", + "description": "Alert state for the alert" + } + }, + "VPNGWBandWidthUtilThreshold": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VPN GW Band Width Util Threshold", + "description": "Threshold for the alert" + } + }, + "VPNGWEgressAlertSeverity": { + "type": "String", + "defaultValue": "0", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "VPN GW Egress Alert Severity", + "description": "Severity of the alert" + } + }, + "VPNGWEgressWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "VPN GW Egress Window Size", + "description": "Window size for the alert" + } + }, + "VPNGWEgressEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "VPN GW Egress Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VPNGWEgressPolicyEffect": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "VPN GW Egress Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "VPNGWEgressAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VPN GW Egress Alert State", + "description": "Alert state for the alert" + } + }, + "VPNGWEgressThreshold": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VPN GW Egress Threshold", + "description": "Threshold for the alert" + } + }, + "VPNGWTunnelEgressPacketDropCountAlertSeverity": { + "type": "String", + "defaultValue": "3", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "VPN GW Tunnel Egress Packet Drop Count Alert Severity", + "description": "Severity of the alert" + } + }, + "VPNGWTunnelEgressPacketDropCountWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "VPN GW Tunnel Egress Packet Drop Count Window Size", + "description": "Window size for the alert" + } + }, + "VPNGWTunnelEgressPacketDropCountFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "VPN GW Tunnel Egress Packet Drop Count Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VPNGWTunnelEgressPacketDropCountPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "VPN GW Tunnel Egress Packet Drop Count Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "VPNGWTunnelEgressPacketDropCountAlertState": { + "type": "string", + "defaultValue": "true" + }, + "VPNGWTunnelEgressPacketDropMismatchAlertSeverity": { + "type": "String", + "defaultValue": "3", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "VPN GW Tunnel Egress Packet Drop Mismatch Alert Severity", + "description": "Severity of the alert" + } + }, + "VPNGWTunnelEgressPacketDropMismatchWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "VPN GW Tunnel Egress Packet Drop Mismatch Window Size", + "description": "Window size for the alert" + } + }, + "VPNGWTunnelEgressPacketDropMismatchFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "VPN GW Tunnel Egress Packet Drop Mismatch Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VPNGWTunnelEgressPacketDropMismatchPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "VPN GW Tunnel Egress Packet Drop Mismatch Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "VPNGWTunnelEgressPacketDropMismatchAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VPN GW Tunnel Egress Packet Drop Mismatch Alert State", + "description": "Alert state for the alert" + } + }, + "VPNGWIngressAlertSeverity": { + "type": "string", + "defaultValue": "0", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "VPN GW Ingress Alert Severity", + "description": "Severity of the alert" + } + }, + "VPNGWIngressWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "VPN GW Ingress Window Size", + "description": "Window size for the alert" + } + }, + "VPNGWIngressEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "VPN GW Ingress Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VPNGWIngressPolicyEffect": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "VPN GW Ingress Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "VPNGWIngressAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VPN GW Ingress Alert State", + "description": "Alert state for the alert" + } + }, + "VPNGWIngressThreshold": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VPN GW Ingress Threshold", + "description": "Threshold for the alert" + } + }, + "VPNGWIngressAutoMitigate": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VPN GW Ingress Auto Mitigate", + "description": "Auto Mitigate for the alert" + } + }, + "VPNGWTunnelIngressPacketDropCountAlertSeverity": { + "type": "String", + "defaultValue": "3", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "VPN GW Tunnel Ingress Packet Drop Count Alert Severity", + "description": "Severity of the alert" + } + }, + "VPNGWTunnelIngressPacketDropCountWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "VPN GW Tunnel Ingress Packet Drop Count Window Size", + "description": "Window size for the alert" + } + }, + "VPNGWTunnelIngressPacketDropCountFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "VPN GW Tunnel Ingress Packet Drop Count Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VPNGWTunnelIngressPacketDropCountPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "VPN GW Tunnel Ingress Packet Drop Count Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "VPNGWTunnelIngressPacketDropCountAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VPN GW Tunnel Ingress Packet Drop Count Alert State", + "description": "Alert state for the alert" + } + }, + "VPNGWTunnelIngressPacketDropMismatchAlertSeverity": { + "type": "String", + "defaultValue": "3", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "VPN GW Tunnel Ingress Packet Drop Mismatch Alert Severity", + "description": "Severity of the alert" + } + }, + "VPNGWTunnelIngressPacketDropMismatchWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "VPN GW Tunnel Ingress Packet Drop Mismatch Window Size", + "description": "Window size for the alert" + } + }, + "VPNGWTunnelIngressPacketDropMismatchFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "VPN GW Tunnel Ingress Packet Drop Mismatch Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VPNGWTunnelIngressPacketDropMismatchPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "VPN GW Tunnel Ingress Packet Drop Mismatch Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "VPNGWTunnelIngressPacketDropMismatchAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VPN GW Tunnel Ingress Packet Drop Mismatch Alert State", + "description": "Alert state for the alert" + } + }, + "PDNSZCapacityUtilAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "PDNSZ Capacity Util Alert Severity", + "description": "Severity of the alert" + } + }, + "PDNSZCapacityUtilWindowSize": { + "type": "string", + "defaultValue": "PT1H", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "PDNSZ Capacity Util Window Size", + "description": "Window size for the alert" + } + }, + "PDNSZCapacityUtilEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1H", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "PDNSZ Capacity Util Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "PDNSZCapacityUtilPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "PDNSZ Capacity Util Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "PDNSZCapacityUtilAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "PDNSZ Capacity Util Alert State", + "description": "Alert state for the alert" + } + }, + "PDNSZCapacityUtilThreshold": { + "type": "string", + "defaultValue": "80", + "metadata": { + "displayName": "PDNSZ Capacity Util Threshold", + "description": "Threshold for the alert" + } + }, + "PDNSZQueryVolumeAlertSeverity": { + "type": "String", + "defaultValue": "4", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "PDNSZ Query Volume Alert Severity", + "description": "Severity of the alert" + } + }, + "PDNSZQueryVolumeWindowSize": { + "type": "string", + "defaultValue": "PT1H", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "PDNSZ Query Volume Window Size", + "description": "Window size for the alert" + } + }, + "PDNSZQueryVolumeEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1H", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "PDNSZ Query Volume Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "PDNSZQueryVolumePolicyEffect": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "PDNSZ Query Volume Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "PDNSZQueryVolumeAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "PDNSZ Query Volume Alert State", + "description": "Alert state for the alert" + } + }, + "PDNSZQueryVolumeThreshold": { + "type": "string", + "defaultValue": "500", + "metadata": { + "displayName": "PDNSZ Query Volume Threshold", + "description": "Threshold for the alert" + } + }, + "PDNSZRecordSetCapacityAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "PDNSZ Record Set Capacity Alert Severity", + "description": "Severity of the alert" + } + }, + "PDNSZRecordSetCapacityWindowSize": { + "type": "string", + "defaultValue": "PT1H", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "PDNSZ Record Set Capacity Window Size", + "description": "Window size for the alert" + } + }, + "PDNSZRecordSetCapacityEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1H", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "PDNSZ Record Set Capacity Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "PDNSZRecordSetCapacityPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "PDNSZ Record Set Capacity Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "PDNSZRecordSetCapacityAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "PDNSZ Record Set Capacity Alert State", + "description": "Alert state for the alert" + } + }, + "PDNSZRecordSetCapacityThreshold": { + "type": "string", + "defaultValue": "80", + "metadata": { + "displayName": "PDNSZ Record Set Capacity Threshold", + "description": "Threshold for the alert" + } + }, + "PDNSZRegistrationCapacityUtilAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "PDNSZ Registration Capacity Util Alert Severity", + "description": "Severity of the alert" + } + }, + "PDNSZRegistrationCapacityUtilWindowSize": { + "type": "string", + "defaultValue": "PT1H", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "PDNSZ Registration Capacity Util Window Size", + "description": "Window size for the alert" + } + }, + "PDNSZRegistrationCapacityUtilEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1H", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "PDNSZ Registration Capacity Util Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "PDNSZRegistrationCapacityUtilPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "PDNSZ Registration Capacity Util Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "PDNSZRegistrationCapacityUtilAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "PDNSZ Registration Capacity Util Alert State", + "description": "Alert state for the alert" + } + }, + "PDNSZRegistrationCapacityUtilThreshold": { + "type": "string", + "defaultValue": "80", + "metadata": { + "displayName": "PDNSZ Registration Capacity Util Threshold", + "description": "Threshold for the alert" + } + }, + "PIPDDoSAttackAlertSeverity": { + "type": "String", + "defaultValue": "1", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "PIP DDoS Attack Alert Severity", + "description": "Severity of the alert" + } + }, + "PIPDDoSAttackWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "PIP DDoS Attack Window Size", + "description": "Window size for the alert" + } + }, + "PIPDDoSAttackEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "PIP DDoS Attack Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "PIPDDoSAttackPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "PIP DDoS Attack Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "PIPDDoSAttackAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "PIP DDoS Attack Alert State", + "description": "Alert state for the alert" + } + }, + "PIPDDoSAttackThreshold": { + "type": "string", + "defaultValue": "0", + "metadata": { + "displayName": "PIP DDoS Attack Threshold", + "description": "Threshold for the alert" + } + }, + "PIPPacketsInDDoSAlertSeverity": { + "type": "String", + "defaultValue": "4", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "PIP Packets In DDoS Alert Severity", + "description": "Severity of the alert" + } + }, + "PIPPacketsInDDoSWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "PIP Packets In DDoS Window Size", + "description": "Window size for the alert" + } + }, + "PIPPacketsInDDoSEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "PIP Packets In DDoS Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "PIPPacketsInDDoSPolicyEffect": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "PIP Packets In DDoS Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "PIPPacketsInDDoSAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "PIP Packets In DDoS Alert State", + "description": "Alert state for the alert" + } + }, + "PIPPacketsInDDoSThreshold": { + "type": "string", + "defaultValue": "40000", + "metadata": { + "displayName": "PIP Packets In DDoS Threshold", + "description": "Threshold for the alert" + } + }, + "PIPVIPAvailabilityAlertSeverity": { + "type": "String", + "defaultValue": "1", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "PIP VIP Availability Alert Severity", + "description": "Severity of the alert" + } + }, + "PIPVIPAvailabilityWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "PIP VIP Availability Window Size", + "description": "Window size for the alert" + } + }, + "PIPVIPAvailabilityEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "PIP VIP Availability Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "PIPVIPAvailabilityPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "PIP VIP Availability Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "PIPVIPAvailabilityAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "PIP VIP Availability Alert State", + "description": "Alert state for the alert" + } + }, + "PIPVIPAvailabilityThreshold": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "PIP VIP Availability Threshold", + "description": "Threshold for the alert" + } + }, + "PIPBytesInDDoSAlertSeverity": { + "type": "String", + "defaultValue": "4", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "PIP Bytes In DDoS Alert Severity", + "description": "Severity of the alert" + } + }, + "PIPBytesInDDoSWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "PIP Bytes In DDoS Window Size", + "description": "Window size for the alert" + } + }, + "PIPBytesInDDoSEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "PIP Bytes In DDoS Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "PIPBytesInDDoSPolicyEffect": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "PIP Bytes In DDoS Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "PIPBytesInDDoSAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "PIP Bytes In DDoS Alert State", + "description": "Alert state for the alert" + } + }, + "PIPBytesInDDoSThreshold": { + "type": "string", + "defaultValue": "8000000", + "metadata": { + "displayName": "PIP Bytes In DDoS Threshold", + "description": "Threshold for the alert" + } + }, + "ERGwExpressRouteBitsInAlertSeverity": { + "type": "String", + "defaultValue": "0", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "ER Gw Express Route Bits In Alert Severity", + "description": "Severity of the alert" + } + }, + "ERGwExpressRouteBitsInWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "ER Gw Express Route Bits In Window Size", + "description": "Window size for the alert" + } + }, + "ERGwExpressRouteBitsInEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "ER Gw Express Route Bits In Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "ERGwExpressRouteBitsInPolicyEffect": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "ER Gw Express Route Bits In Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "ERGwExpressRouteBitsInAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "ER Gw Express Route Bits In Alert State", + "description": "Alert state for the alert" + } + }, + "ERGwExpressRouteBitsInThreshold": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "ER Gw Express Route Bits In Threshold", + "description": "Threshold for the alert" + } + }, + "ERGwExpressRouteBitsOutAlertSeverity": { + "type": "String", + "defaultValue": "0", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "ER Gw Express Route Bits Out Alert Severity", + "description": "Severity of the alert" + } + }, + "ERGwExpressRouteBitsOutWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "ER Gw Express Route Bits Out Window Size", + "description": "Window size for the alert" + } + }, + "ERGwExpressRouteBitsOutEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "ER Gw Express Route Bits Out Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "ERGwExpressRouteBitsOutPolicyEffect": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "ER Gw Express Route Bits Out Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "ERGwExpressRouteBitsOutAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "ER Gw Express Route Bits Out Alert State", + "description": "Alert state for the alert" + } + }, + "ERGwExpressRouteBitsOutThreshold": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "ER Gw Express Route Bits Out Threshold", + "description": "Threshold for the alert" + } + }, + "ERGwExpressRouteCpuUtilAlertSeverity": { + "type": "String", + "defaultValue": "1", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "ER Gw Express Route Cpu Util Alert Severity", + "description": "Severity of the alert" + } + }, + "ERGwExpressRouteCpuUtilWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "ER Gw Express Route Cpu Util Window Size", + "description": "Window size for the alert" + } + }, + "ERGwExpressRouteCpuUtilEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "ER Gw Express Route Cpu Util Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "ERGwExpressRouteCpuUtilPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "ER Gw Express Route Cpu Util Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "ERGwExpressRouteCpuUtilAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "ER Gw Express Route Cpu Util Alert State", + "description": "Alert state for the alert" + } + }, + "ERGwExpressRouteCpuUtilThreshold": { + "type": "string", + "defaultValue": "80", + "metadata": { + "displayName": "ER Gw Express Route Cpu Util Threshold", + "description": "Threshold for the alert" + } + }, + "VNETDDOSAttackAlertSeverity": { + "type": "String", + "defaultValue": "1", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "VNET DDoS Attack Alert Severity", + "description": "Severity of the alert" + } + }, + "VNETDDOSAttackWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "VNET DDoS Attack Window Size", + "description": "Window size for the alert" + } + }, + "VNETDDOSAttackEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "VNET DDoS Attack Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VNETDDOSAttackPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "VNET DDoS Attack Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "VNETDDOSAttackAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VNET DDoS Attack Alert State", + "description": "Alert state for the alert" + } + }, + "VNETDDOSAttackThreshold": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VNET DDoS Attack Threshold", + "description": "Threshold for the alert" + } + }, + "VnetGwTunnelEgressPacketDropCountAlertSeverity": { + "type": "String", + "defaultValue": "1", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "Vnet Gw Tunnel Egress Packet Drop Count Alert Severity", + "description": "Severity of the alert" + } + }, + "VnetGwTunnelEgressPacketDropCountWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "Vnet Gw Tunnel Egress Packet Drop Count Window Size", + "description": "Window size for the alert" + } + }, + "VnetGwTunnelEgressPacketDropCountEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "Vnet Gw Tunnel Egress Packet Drop Count Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VnetGwTunnelEgressPacketDropCountPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Vnet Gw Tunnel Egress Packet Drop Count Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "VnetGwTunnelEgressPacketDropCountAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Vnet Gw Tunnel Egress Packet Drop Count Alert State", + "description": "Alert state for the alert" + } + }, + "VnetGwTunnelEgressPacketDropMismatchAlertSeverity": { + "type": "String", + "defaultValue": "3", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "Vnet Gw Tunnel Egress Packet Drop Mismatch Alert Severity", + "description": "Severity of the alert" + } + }, + "VnetGwTunnelEgressPacketDropMismatchWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "Vnet Gw Tunnel Egress Packet Drop Mismatch Window Size", + "description": "Window size for the alert" + } + }, + "VnetGwTunnelEgressPacketDropMismatchEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "Vnet Gw Tunnel Egress Packet Drop Mismatch Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VnetGwTunnelEgressPacketDropMismatchPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Vnet Gw Tunnel Egress Packet Drop Mismatch Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "VnetGwTunnelEgressPacketDropMismatchAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Vnet Gw Tunnel Egress Packet Drop Mismatch Alert State", + "description": "Alert state for the alert" + } + }, + "VnetGwExpressRouteBitsPerSecondAlertSeverity": { + "type": "String", + "defaultValue": "0", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "Vnet Gw Express Route Bits Per Second Alert Severity", + "description": "Severity of the alert" + } + }, + "VnetGwExpressRouteBitsPerSecondWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "Vnet Gw Express Route Bits Per Second Window Size", + "description": "Window size for the alert" + } + }, + "VnetGwExpressRouteBitsPerSecondEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "Vnet Gw Express Route Bits Per Second Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VnetGwExpressRouteBitsPerSecondPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Vnet Gw Express Route Bits Per Second Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "VnetGwExpressRouteBitsPerSecondAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Vnet Gw Express Route Bits Per Second Alert State", + "description": "Alert state for the alert" + } + }, + "VnetGwExpressRouteBitsPerSecondThreshold": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "Vnet Gw Express Route Bits Per Second Threshold", + "description": "Threshold for the alert" + } + }, + "VnetGwTunnelIngressPacketDropMismatchAlertSeverity": { + "type": "String", + "defaultValue": "3", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "Vnet Gw Tunnel Ingress Packet Drop Mismatch Alert Severity", + "description": "Severity of the alert" + } + }, + "VnetGwTunnelIngressPacketDropMismatchWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "Vnet Gw Tunnel Ingress Packet Drop Mismatch Window Size", + "description": "Window size for the alert" + } + }, + "VnetGwTunnelIngressPacketDropMismatchEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "Vnet Gw Tunnel Ingress Packet Drop Mismatch Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VnetGwTunnelIngressPacketDropMismatchPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Vnet Gw Tunnel Ingress Packet Drop Mismatch Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "VnetGwTunnelIngressPacketDropMismatchAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Vnet Gw Tunnel Ingress Packet Drop Mismatch Alert State", + "description": "Alert state for the alert" + } + }, + "VnetGwTunnelIngressPacketDropCountAlertSeverity": { + "type": "String", + "defaultValue": "3", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "Vnet Gw Tunnel Ingress Packet Drop Count Alert Severity", + "description": "Severity of the alert" + } + }, + "VnetGwTunnelIngressPacketDropCountWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "Vnet Gw Tunnel Ingress Packet Drop Count Window Size", + "description": "Window size for the alert" + } + }, + "VnetGwTunnelIngressPacketDropCountEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "Vnet Gw Tunnel Ingress Packet Drop Count Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VnetGwTunnelIngressPacketDropCountPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Vnet Gw Tunnel Ingress Packet Drop Count Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "VnetGwTunnelIngressPacketDropCountAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Vnet Gw Tunnel Ingress Packet Drop Count Alert State", + "description": "Alert state for the alert" + } + }, + "ERCIRBgpAvailabilityAlertSeverity": { + "type": "String", + "defaultValue": "0", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "ERCIR Bgp Availability Alert Severity", + "description": "Severity of the alert" + } + }, + "ERCIRBgpAvailabilityWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "ERCIR Bgp Availability Window Size", + "description": "Window size for the alert" + } + }, + "ERCIRBgpAvailabilityEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "ERCIR Bgp Availability Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "ERCIRBgpAvailabilityPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "ERCIR Bgp Availability Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "ERCIRBgpAvailabilityAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "ERCIR Bgp Availability Alert State", + "description": "Alert state for the alert" + } + }, + "ERCIRBgpAvailabilityThreshold": { + "type": "string", + "defaultValue": "90", + "metadata": { + "displayName": "ERCIR Bgp Availability Threshold", + "description": "Threshold for the alert" + } + }, + "ERCIRArpAvailabilityAlertSeverity": { + "type": "String", + "defaultValue": "0", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "ERCIR Arp Availability Alert Severity", + "description": "Severity of the alert" + } + }, + "ERCIRArpAvailabilityWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "ERCIR Arp Availability Window Size", + "description": "Window size for the alert" + } + }, + "ERCIRArpAvailabilityFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "ERCIR Arp Availability Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "ERCIRArpAvailabilityPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "ERCIR ARP Availability Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "ERCIRArpAvailabilityAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "ERCIR Arp Availability Alert State", + "description": "Alert state for the alert" + } + }, + "ERCIRArpAvailabilityThreshold": { + "type": "string", + "defaultValue": "90", + "metadata": { + "displayName": "ERCIR Arp Availability Threshold", + "description": "Threshold for the alert" + } + }, + "AFWSNATPortUtilizationAlertSeverity": { + "type": "String", + "defaultValue": "1", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "AFW SNAT Port Utilization Alert Severity", + "description": "Severity of the alert" + } + }, + "AFWSNATPortUtilizationWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "AFW SNAT Port Utilization Window Size", + "description": "Window size for the alert" + } + }, + "AFWSNATPortUtilizationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "AFW SNAT Port Utilization Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "AFWSNATPortUtilizationPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "AFW SNAT Port Utilization Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "AFWSNATPortUtilizationAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "AFW SNAT Port Utilization Alert State", + "description": "Alert state for the alert" + } + }, + "AFWSNATPortUtilizationThreshold": { + "type": "string", + "defaultValue": "80", + "metadata": { + "displayName": "AFW SNAT Port Utilization Threshold", + "description": "Threshold for the alert" + } + }, + "FirewallHealthAlertSeverity": { + "type": "String", + "defaultValue": "0", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "Firewall Health Alert Severity", + "description": "Severity of the alert" + } + }, + "FirewallHealthWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "Firewall Health Window Size", + "description": "Window size for the alert" + } + }, + "FirewallHealthEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "Firewall Health Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "FirewallHealthPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Firewall Health Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "FirewallHealthAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Firewall Health Alert State", + "description": "Alert state for the alert" + } + }, + "FirewallHealthThreshold": { + "type": "string", + "defaultValue": "90", + "metadata": { + "displayName": "Firewall Health Threshold", + "description": "Threshold for the alert" + } + }, + "activityFWDeletePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Activity FW Delete Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "activityFWDeleteAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Activity FW Delete Alert State", + "description": "Alert state for the alert" + } + }, + "activityNSGDeletePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Activity NSG Delete Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "activityNSGDeleteAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Activity NSG Delete Alert State", + "description": "Alert state for the alert" + } + }, + "activityUDRUpdatePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Activity UDR Update Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "activityUDRUpdateAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Activity UDR Update Alert State", + "description": "Alert state for the alert" + } + }, + "activityVPNGWDeletePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Activity VPN GW Delete Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "activityVPNGWDeleteAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Activity VPN GW Delete Alert State", + "description": "Alert state for the alert" + } + }, + "LBDatapathAvailabilityAlertSeverity": { + "type": "String", + "defaultValue": "0", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "LB Data path Availability Alert Severity", + "description": "Severity of the alert" + } + }, + "LBDatapathAvailabilityWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "LB Data path Availability Window Size", + "description": "Window size for the alert" + } + }, + "LBDatapathAvailabilityEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "LB Data path Availability Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "LBDatapathAvailabilityPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "LB Data path Availability Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "LBDatapathAvailabilityAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "LB Data path Availability Alert State", + "description": "Alert state for the alert" + } + }, + "LBGlobalBackendAvailabilityAlertSeverity": { + "type": "String", + "defaultValue": "0", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "LB Global Backend Availability Alert Severity", + "description": "Severity of the alert" + } + }, + "LBGlobalBackendAvailabilityWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "LB Global Backend Availability Window Size", + "description": "Window size for the alert" + } + }, + "LBGlobalBackendAvailabilityEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "LB Global Backend Availability Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "LBGlobalBackendAvailabilityPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "LB Global Backend Availability Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "LBGlobalBackendAvailabilityAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "LB Global Backend Availability Alert State", + "description": "Alert state for the alert" + } + }, + "LBHealthProbeStatusAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "LB Health Probe Status Alert Severity", + "description": "Severity of the alert" + } + }, + "LBHealthProbeStatusWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "LB Health Probe Status Window Size", + "description": "Window size for the alert" + } + }, + "LBHealthProbeStatusEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "LB Health Probe Status Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "LBHealthProbeStatusPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "LB Health Probe Status Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "LBHealthProbeStatusAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "LB Health Probe Status Alert State", + "description": "Alert state for the alert" + } + }, + "LBUsedSNATPortsAlertSeverity": { + "type": "String", + "defaultValue": "1", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "LB Used SNAT Ports Alert Severity", + "description": "Severity of the alert" + } + }, + "LBUsedSNATPortsWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "LB Used SNAT Ports Window Size", + "description": "Window size for the alert" + } + }, + "LBUsedSNATPortsEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "LB Used SNAT Ports Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "LBUsedSNATPortsPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "LB Used SNAT Ports Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "LBUsedSNATPortsAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "LB Used SNAT Ports Alert State", + "description": "Alert state for the alert" + } + }, + "ERPBitsInPerSecondAlertSeverity": { + "type": "String", + "defaultValue": "0", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "ERP Bits In Per Second Alert Severity", + "description": "Severity of the alert" + } + }, + "ERPBitsInPerSecondWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "ERP Bits In Per Second Window Size", + "description": "Window size for the alert" + } + }, + "ERPBitsInPerSecondEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "ERP Bits In Per Second Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "ERPBitsInPerSecondPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "ERP Bits In Per Second Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "ERPBitsInPerSecondAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "ERP Bits In Per Second Alert State", + "description": "Alert state for the alert" + } + }, + "ERPBitsOutPerSecondAlertSeverity": { + "type": "String", + "defaultValue": "0", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "ERP Bits Out Per Second Alert Severity", + "description": "Severity of the alert" + } + }, + "ERPBitsOutPerSecondWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "ERP Bits Out Per Second Window Size", + "description": "Window size for the alert" + } + }, + "ERPBitsOutPerSecondEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "ERP Bits Out Per Second Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "ERPBitsOutPerSecondPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "ERP Bits Out Per Second Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "ERPBitsOutPerSecondAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "ERP Bits Out Per Second Alert State", + "description": "Alert state for the alert" + } + }, + "ERPLineProtocolAlertSeverity": { + "type": "String", + "defaultValue": "0", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "ERP Line Protocol Alert Severity", + "description": "Severity of the alert" + } + }, + "ERPLineProtocolWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "ERP Line Protocol Window Size", + "description": "Window size for the alert" + } + }, + "ERPLineProtocolEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "ERP Line Protocol Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "ERPLineProtocolPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "ERP Line Protocol Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "ERPLineProtocolAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "ERP Line Protocol Alert State", + "description": "Alert state for the alert" + } + }, + "ERPRxLightLevelHighAlertSeverity": { + "type": "String", + "defaultValue": "1", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "ERP Rx Light Level High Alert Severity", + "description": "Severity of the alert" + } + }, + "ERPRxLightLevelHighWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "ERP Rx Light Level High Window Size", + "description": "Window size for the alert" + } + }, + "ERPRxLightLevelHighEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "ERP Rx Light Level High Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "ERPRxLightLevelHighPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "ERP Rx Light Level High Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "ERPRxLightLevelHighAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "ERP Rx Light Level High Alert State", + "description": "Alert state for the alert" + } + }, + "ERPRxLightLevelLowAlertSeverity": { + "type": "String", + "defaultValue": "1", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "ERP Rx Light Level Low Alert Severity", + "description": "Severity of the alert" + } + }, + "ERPRxLightLevelLowWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "ERP Rx Light Level Low Window Size", + "description": "Window size for the alert" + } + }, + "ERPRxLightLevelLowEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "ERP Rx Light Level Low Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "ERPRxLightLevelLowPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "ERP Rx Light Level Low Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "ERPRxLightLevelLowAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "ERP Rx Light Level Low Alert State", + "description": "Alert state for the alert" + } + }, + "ERPTxLightLevelHighAlertSeverity": { + "type": "String", + "defaultValue": "1", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "ERP Tx Light Level High Alert Severity", + "description": "Severity of the alert" + } + }, + "ERPTxLightLevelHighWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "ERP Tx Light Level High Window Size", + "description": "Window size for the alert" + } + }, + "ERPTxLightLevelHighEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "ERP Tx Light Level High Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "ERPTxLightLevelHighPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "ERP Tx Light Level High Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "ERPTxLightLevelHighAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "ERP Tx Light Level High Alert State", + "description": "Alert state for the alert" + } + }, + "ERPTxLightLevelLowAlertSeverity": { + "type": "String", + "defaultValue": "1", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "ERP Tx Light Level Low Alert Severity", + "description": "Severity of the alert" + } + }, + "ERPTxLightLevelLowWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "ERP Tx Light Level Low Window Size", + "description": "Window size for the alert" + } + }, + "ERPTxLightLevelLowEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "ERP Tx Light Level Low Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "ERPTxLightLevelLowPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "ERP Tx Light Level Low Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "ERPTxLightLevelLowAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "ERP Tx Light Level Low Alert State", + "description": "Alert state for the alert" + } + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "ALZ_ERCIRQoSDropBitsinPerSec", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ERCIR_QosDropBitsInPerSecond_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('ERCIRQoSDropBitsinPerSecAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('ERCIRQoSDropBitsinPerSecWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('ERCIRQoSDropBitsinPerSecEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('ERCIRQoSDropBitsinPerSecPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('ERCIRQoSDropBitsinPerSecAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_ERCIRQoSDropBitsoutPerSec", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ERCIR_QosDropBitsOutPerSecond_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('ERCIRQoSDropBitsoutPerSecAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('ERCIRQoSDropBitsoutPerSecWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('ERCIRQoSDropBitsoutPerSecEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('ERCIRQoSDropBitsoutPerSecPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('ERCIRQoSDropBitsoutPerSecAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VPNGwBGPPeerStatus", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VPNGw_BGPPeerStatus_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('VPNGwBGPPeerStatusAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('VPNGwBGPPeerStatusWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('VPNGwBGPPeerStatusEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('VPNGwBGPPeerStatusPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('VPNGwBGPPeerStatusAlertState')]" + }, + "threshold": { + "value": "[[[parameters('VPNGwBGPPeerStatusThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VnetGwERCpuUtil", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VnetGw_ExpressRouteCpuUtil_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('VnetGwERCpuUtilAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('VnetGwERCpuUtilWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('VnetGwERCpuUtilEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('VnetGwERCpuUtilPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('VnetGwERCpuUtilAlertState')]" + }, + "threshold": { + "value": "[[[parameters('VnetGwERCpuUtilThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VnetGwTunnelBW", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VnetGw_TunnelBandwidth_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('VnetGwTunnelBWAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('VnetGwTunnelBWWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('VnetGwTunnelBWEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('VnetGwTunnelBWPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('VnetGwTunnelBWAlertState')]" + }, + "threshold": { + "value": "[[[parameters('VnetGwTunnelBWThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VnetGwTunnelEgress", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VnetGw_TunnelEgress_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('VnetGwTunnelEgressAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('VnetGwTunnelEgressWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('VnetGwTunnelEgressEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('VnetGwTunnelEgressPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('VnetGwTunnelEgressAlertState')]" + }, + "threshold": { + "value": "[[[parameters('VnetGwTunnelEgressThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VnetGwTunnelIngress", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VnetGw_TunnelIngress_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('VnetGwTunnelIngressAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('VnetGwTunnelIngressWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('VnetGwTunnelIngressEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('VnetGwTunnelIngressPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('VnetGwTunnelIngressAlertState')]" + }, + "threshold": { + "value": "[[[parameters('VnetGwTunnelIngressThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VPNGWBandWidthUtil", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VPNGw_BandwidthUtil_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('VPNGWBandWidthUtilAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('VPNGWBandWidthUtilWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('VPNGWBandWidthUtilEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('VPNGWBandWidthUtilPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('VPNGWBandWidthUtilAlertState')]" + }, + "threshold": { + "value": "[[[parameters('VPNGWBandWidthUtilThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VPNGWEgress", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VPNGw_Egress_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('VPNGWEgressAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('VPNGWEgressWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('VPNGWEgressEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('VPNGWEgressPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('VPNGWEgressAlertState')]" + }, + "threshold": { + "value": "[[[parameters('VPNGWEgressThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VPNGWTunnelEgressPacketDropCount", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VPNGw_TunnelEgressPacketDropCount_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('VPNGWTunnelEgressPacketDropCountAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('VPNGWTunnelEgressPacketDropCountWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('VPNGWTunnelEgressPacketDropCountFrequency')]" + }, + "effect": { + "value": "[[[parameters('VPNGWTunnelEgressPacketDropCountPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('VPNGWTunnelEgressPacketDropCountAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VPNGWTunnelEgressPacketDropMismatch", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VPNGw_TunnelEgressPacketDropMismatch_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('VPNGWTunnelEgressPacketDropMismatchAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('VPNGWTunnelEgressPacketDropMismatchWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('VPNGWTunnelEgressPacketDropMismatchFrequency')]" + }, + "effect": { + "value": "[[[parameters('VPNGWTunnelEgressPacketDropMismatchPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('VPNGWTunnelEgressPacketDropMismatchAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VPNGWIngress", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VPNGw_Ingress_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('VPNGWIngressAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('VPNGWIngressWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('VPNGWIngressEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('VPNGWIngressPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('VPNGWIngressAlertState')]" + }, + "threshold": { + "value": "[[[parameters('VPNGWIngressThreshold')]" + }, + "autoMitigate": { + "value": "[[[parameters('VPNGWIngressAutoMitigate')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VPNGWTunnelIngressPacketDropCount", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VPNGw_TunnelIngressPacketDropCount_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('VPNGWTunnelIngressPacketDropCountAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('VPNGWTunnelIngressPacketDropCountWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('VPNGWTunnelIngressPacketDropCountFrequency')]" + }, + "effect": { + "value": "[[[parameters('VPNGWTunnelIngressPacketDropCountPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('VPNGWTunnelIngressPacketDropCountAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VPNGWTunnelIngressPacketDropMismatch", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VPNGw_TunnelIngressPacketDropMismatch_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('VPNGWTunnelIngressPacketDropMismatchAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('VPNGWTunnelIngressPacketDropMismatchWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('VPNGWTunnelIngressPacketDropMismatchFrequency')]" + }, + "effect": { + "value": "[[[parameters('VPNGWTunnelIngressPacketDropMismatchPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('VPNGWTunnelIngressPacketDropMismatchAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_PDNSZCapacityUtil", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_PDNSZ_CapacityUtil_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('PDNSZCapacityUtilAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('PDNSZCapacityUtilWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('PDNSZCapacityUtilEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('PDNSZCapacityUtilPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('PDNSZCapacityUtilAlertState')]" + }, + "threshold": { + "value": "[[[parameters('PDNSZCapacityUtilThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_PDNSZQueryVolume", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_PDNSZ_QueryVolume_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('PDNSZQueryVolumeAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('PDNSZQueryVolumeWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('PDNSZQueryVolumeEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('PDNSZQueryVolumePolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('PDNSZQueryVolumeAlertState')]" + }, + "threshold": { + "value": "[[[parameters('PDNSZQueryVolumeThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_PDNSZRecordSetCapacity", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_PDNSZ_RecordSetCapacity_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('PDNSZRecordSetCapacityAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('PDNSZRecordSetCapacityWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('PDNSZRecordSetCapacityEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('PDNSZRecordSetCapacityPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('PDNSZRecordSetCapacityAlertState')]" + }, + "threshold": { + "value": "[[[parameters('PDNSZRecordSetCapacityThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_PDNSZRegistrationCapacityUtil", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_DNSZ_RegistrationCapacityUtil_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('PDNSZRegistrationCapacityUtilAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('PDNSZRegistrationCapacityUtilWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('PDNSZRegistrationCapacityUtilEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('PDNSZRegistrationCapacityUtilPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('PDNSZRegistrationCapacityUtilAlertState')]" + }, + "threshold": { + "value": "[[[parameters('PDNSZRegistrationCapacityUtilThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_ERGwExpressRouteBitsIn", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ERGw_ExpressRouteBitsIn_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('ERGwExpressRouteBitsInAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('ERGwExpressRouteBitsInWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('ERGwExpressRouteBitsInEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('ERGwExpressRouteBitsInPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('ERGwExpressRouteBitsInAlertState')]" + }, + "threshold": { + "value": "[[[parameters('ERGwExpressRouteBitsInThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_ERGwExpressRouteBitsOut", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ERGw_ExpressRouteBitsOut_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('ERGwExpressRouteBitsOutAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('ERGwExpressRouteBitsOutWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('ERGwExpressRouteBitsOutEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('ERGwExpressRouteBitsOutPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('ERGwExpressRouteBitsOutAlertState')]" + }, + "threshold": { + "value": "[[[parameters('ERGwExpressRouteBitsOutThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_ERGwExpressRouteCpuUtil", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ERGw_ExpressRouteCpuUtil_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('ERGwExpressRouteCpuUtilAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('ERGwExpressRouteCpuUtilWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('ERGwExpressRouteCpuUtilEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('ERGwExpressRouteCpuUtilPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('ERGwExpressRouteCpuUtilAlertState')]" + }, + "threshold": { + "value": "[[[parameters('ERGwExpressRouteCpuUtilThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VnetGwTunnelEgressPacketDropCount", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VnetGw_TunnelEgressPacketDropCount_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('VnetGwTunnelEgressPacketDropCountAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('VnetGwTunnelEgressPacketDropCountWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('VnetGwTunnelEgressPacketDropCountEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('VnetGwTunnelEgressPacketDropCountPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('VnetGwTunnelEgressPacketDropCountAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VnetGwTunnelEgressPacketDropMismatch", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VnetGw_TunnelEgressPacketDropMismatch_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('VnetGwTunnelEgressPacketDropMismatchAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('VnetGwTunnelEgressPacketDropMismatchWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('VnetGwTunnelEgressPacketDropMismatchEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('VnetGwTunnelEgressPacketDropMismatchPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('VnetGwTunnelEgressPacketDropMismatchAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VnetGwExpressRouteBitsPerSecond", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VnetGw_ExpressRouteBitsPerSecond_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('VnetGwExpressRouteBitsPerSecondAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('VnetGwExpressRouteBitsPerSecondWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('VnetGwExpressRouteBitsPerSecondEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('VnetGwExpressRouteBitsPerSecondPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('VnetGwExpressRouteBitsPerSecondAlertState')]" + }, + "threshold": { + "value": "[[[parameters('VnetGwExpressRouteBitsPerSecondThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VnetGwTunnelIngressPacketDropMismatch", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VnetGw_TunnelIngressPacketDropMismatch_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('VnetGwTunnelIngressPacketDropMismatchAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('VnetGwTunnelIngressPacketDropMismatchWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('VnetGwTunnelIngressPacketDropMismatchEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('VnetGwTunnelIngressPacketDropMismatchPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('VnetGwTunnelIngressPacketDropMismatchAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VnetGwTunnelIngressPacketDropCount", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VnetGw_TunnelIngressPacketDropCount_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('VnetGwTunnelIngressPacketDropCountAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('VnetGwTunnelIngressPacketDropCountWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('VnetGwTunnelIngressPacketDropCountEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('VnetGwTunnelIngressPacketDropCountPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('VnetGwTunnelIngressPacketDropCountAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_ERCIRBgpAvailability", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ERCIR_BgpAvailability_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('ERCIRBgpAvailabilityAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('ERCIRBgpAvailabilityWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('ERCIRBgpAvailabilityEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('ERCIRBgpAvailabilityPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('ERCIRBgpAvailabilityAlertState')]" + }, + "threshold": { + "value": "[[[parameters('ERCIRBgpAvailabilityThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_ERCIRArpAvailability", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ERCIR_ArpAvailability_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('ERCIRArpAvailabilityAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('ERCIRArpAvailabilityWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('ERCIRArpAvailabilityFrequency')]" + }, + "effect": { + "value": "[[[parameters('ERCIRArpAvailabilityPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('ERCIRArpAvailabilityAlertState')]" + }, + "threshold": { + "value": "[[[parameters('ERCIRArpAvailabilityThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_AFWSNATPortUtilization", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_AFW_SNATPortUtilization_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('AFWSNATPortUtilizationAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('AFWSNATPortUtilizationWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('AFWSNATPortUtilizationFrequency')]" + }, + "effect": { + "value": "[[[parameters('AFWSNATPortUtilizationPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('AFWSNATPortUtilizationAlertState')]" + }, + "threshold": { + "value": "[[[parameters('AFWSNATPortUtilizationThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_PIPBytesInDDoSEvaluationFrequency", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_PublicIp_BytesInDDoSAttack_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('PIPBytesInDDoSAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('PIPBytesInDDoSWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('PIPBytesInDDoSEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('PIPBytesInDDoSPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('PIPBytesInDDoSAlertState')]" + }, + "threshold": { + "value": "[[[parameters('PIPBytesInDDoSThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_PIPDDoSAttack", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_PublicIp_DDoSAttack_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('PIPDDoSAttackAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('PIPDDoSAttackWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('PIPDDoSAttackEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('PIPDDoSAttackPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('PIPDDoSAttackAlertState')]" + }, + "threshold": { + "value": "[[[parameters('PIPDDoSAttackThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_PIPPacketsInDDoS", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_PublicIp_PacketsInDDoSAttack_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('PIPPacketsInDDoSAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('PIPPacketsInDDoSWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('PIPPacketsInDDoSEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('PIPPacketsInDDoSPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('PIPPacketsInDDoSAlertState')]" + }, + "threshold": { + "value": "[[[parameters('PIPPacketsInDDoSThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_PIPVIPAvailability", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_PublicIp_VIPAvailability_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('PIPVIPAvailabilityAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('PIPVIPAvailabilityWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('PIPVIPAvailabilityEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('PIPVIPAvailabilityPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('PIPVIPAvailabilityAlertState')]" + }, + "threshold": { + "value": "[[[parameters('PIPVIPAvailabilityThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VNETDDOSAttack", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VNET_DDoSAttack_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('VNETDDOSAttackAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('VNETDDOSAttackWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('VNETDDOSAttackEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('VNETDDOSAttackPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('VNETDDOSAttackAlertState')]" + }, + "threshold": { + "value": "[[[parameters('VNETDDOSAttackThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_FirewallHealth", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_AFW_FirewallHealth_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('FirewallHealthAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('FirewallHealthWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('FirewallHealthEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('FirewallHealthPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('FirewallHealthAlertState')]" + }, + "threshold": { + "value": "[[[parameters('FirewallHealthThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_activityFWDelete", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_Firewall_Delete", + "parameters": { + "effect": { + "value": "[[[parameters('activityFWDeletePolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('activityFWDeleteAlertState')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_activityNSGDelete", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_NSG_Delete", + "parameters": { + "effect": { + "value": "[[[parameters('activityNSGDeletePolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('activityNSGDeleteAlertState')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_activityUDRUpdate", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_RouteTable_Update", + "parameters": { + "effect": { + "value": "[[[parameters('activityUDRUpdatePolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('activityUDRUpdateAlertState')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_activityVPNGWDelete", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_VPNGateway_Delete", + "parameters": { + "effect": { + "value": "[[[parameters('activityVPNGWDeletePolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('activityVPNGWDeleteAlertState')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_LBDataPathAvailability", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ALB_DataPathAvailability_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('LBDataPathAvailabilityAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('LBDataPathAvailabilityWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('LBDataPathAvailabilityEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('LBDataPathAvailabilityPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('LBDataPathAvailabilityAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_LBGlobalBackendAvailability", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ALB_GlobalBackendAvailability_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('LBGlobalBackendAvailabilityAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('LBGlobalBackendAvailabilityWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('LBGlobalBackendAvailabilityEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('LBGlobalBackendAvailabilityPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('LBGlobalBackendAvailabilityAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_LBHealthProbeStatus", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ALB_HealthProbeStatus_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('LBHealthProbeStatusAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('LBHealthProbeStatusWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('LBHealthProbeStatusEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('LBHealthProbeStatusPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('LBHealthProbeStatusAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_LBUsedSNATPorts", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ALB_UsedSNATPorts_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('LBUsedSNATPortsAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('LBUsedSNATPortsWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('LBUsedSNATPortsEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('LBUsedSNATPortsPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('LBUsedSNATPortsAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_ERPBitsInPerSecond", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ERP_ExpressRouteBitsIn_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('ERPBitsInPerSecondAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('ERPBitsInPerSecondWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('ERPBitsInPerSecondEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('ERPBitsInPerSecondPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('ERPBitsInPerSecondAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_ERPBitsOutPerSecond", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ERP_ExpressRouteBitsOut_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('ERPBitsOutPerSecondAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('ERPBitsOutPerSecondWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('ERPBitsOutPerSecondEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('ERPBitsOutPerSecondPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('ERPBitsOutPerSecondAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_ERPLineProtocol", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ERP_ExpressRoutLineProtocol_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('ERPLineProtocolAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('ERPLineProtocolWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('ERPLineProtocolEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('ERPLineProtocolPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('ERPLineProtocolAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_ERPRxLightLevelHigh", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ERP_ExpressRoutRxLightLevel_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('ERPRxLightLevelHighAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('ERPRxLightLevelHighWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('ERPRxLightLevelHighEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('ERPRxLightLevelHighPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('ERPRxLightLevelHighAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_ERPRxLightLevelLow", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ERP_ExpressRoutRxLightLevellow_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('ERPRxLightLevelLowAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('ERPRxLightLevelLowWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('ERPRxLightLevelLowEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('ERPRxLightLevelLowPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('ERPRxLightLevelLowAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_ERPTxLightLevelHigh", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ERP_ExpressRoutTxLightLevell_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('ERPTxLightLevelHighAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('ERPTxLightLevelHighWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('ERPTxLightLevelHighEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('ERPTxLightLevelHighPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('ERPTxLightLevelHighAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_ERPTxLightLevelLow", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ERP_ExpressRoutTxLightLevellow_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('ERPTxLightLevelLowAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('ERPTxLightLevelLowWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('ERPTxLightLevelLowEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('ERPTxLightLevelLowPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('ERPTxLightLevelLowAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + } + ], + "policyType": "Custom", + "policyDefinitionGroups": null + } + }, + "$fxv#66": { + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "name": "Alerting-LoadBalancing", + "properties": { + "displayName": "Deploy Azure Monitor Baseline Alerts for Load Balancing", + "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Load Balancing Services such as Load Balancer, Application Gateway, Traffic Manager, and Azure Front Door.", + "metadata": { + "version": "1.0.0", + "category": "Monitoring", + "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", + "alzCloudEnvironments": [ + "AzureCloud" + ], + "_deployed_by_amba": true + }, + "parameters": { + "ALZMonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": "MonitorDisable" + }, + "ALZMonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] + }, + "PIPDDoSAttackAlertSeverity": { + "type": "String", + "defaultValue": "1", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "PIP DDoS Attack Alert Severity", + "description": "Severity of the alert for PIP DDoS Attack" + } + }, + "PIPDDoSAttackWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "PIP DDoS Attack Window Size", + "description": "Window size for the alert" + } + }, + "PIPDDoSAttackEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "PIP DDoS Attack Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "PIPDDoSAttackPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "PIP DDoS Attack Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "PIPDDoSAttackAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "PIP DDoS Attack Alert State", + "description": "Alert state for the alert" + } + }, + "PIPDDoSAttackThreshold": { + "type": "string", + "defaultValue": "0", + "metadata": { + "displayName": "PIP DDoS Attack Threshold", + "description": "Threshold for the alert" + } + }, + "PIPPacketsInDDoSAlertSeverity": { + "type": "String", + "defaultValue": "4", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "PIP Packets In DDoS Alert Severity", + "description": "Severity of the alert for PIP Packets In DDoS" + } + }, + "PIPPacketsInDDoSWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "PIP Packets In DDoS Window Size", + "description": "Window size for the alert" + } + }, + "PIPPacketsInDDoSEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "PIP Packets In DDoS Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "PIPPacketsInDDoSPolicyEffect": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "PIP Packets In DDoS Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "PIPPacketsInDDoSAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "PIP Packets In DDoS Alert State", + "description": "Alert state for the alert" + } + }, + "PIPPacketsInDDoSThreshold": { + "type": "string", + "defaultValue": "40000", + "metadata": { + "displayName": "PIP Packets In DDoS Threshold", + "description": "Threshold for the alert" + } + }, + "PIPVIPAvailabilityAlertSeverity": { + "type": "String", + "defaultValue": "1", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "PIP VIP Availability Alert Severity", + "description": "Severity of the alert for PIP VIP Availability" + } + }, + "PIPVIPAvailabilityWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "PIP VIP Availability Window Size", + "description": "Window size for the alert" + } + }, + "PIPVIPAvailabilityEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "PIP VIP Availability Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "PIPVIPAvailabilityPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "PIP VIP Availability Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "PIPVIPAvailabilityAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "PIP VIP Availability Alert State", + "description": "Alert state for the alert" + } + }, + "PIPVIPAvailabilityThreshold": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "PIP VIP Availability Threshold", + "description": "Threshold for the alert" + } + }, + "PIPBytesInDDoSAlertSeverity": { + "type": "String", + "defaultValue": "4", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "PIP Bytes In DDoS Alert Severity", + "description": "Severity of the alert for PIP Bytes In DDoS" + } + }, + "PIPBytesInDDoSWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "PIP Bytes In DDoS Window Size", + "description": "Window size for the alert" + } + }, + "PIPBytesInDDoSEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "PIP Bytes In DDoS Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "PIPBytesInDDoSPolicyEffect": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "PIP Bytes In DDoS Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "PIPBytesInDDoSAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "PIP Bytes In DDoS Alert State", + "description": "Alert state for the alert" + } + }, + "PIPBytesInDDoSThreshold": { + "type": "string", + "defaultValue": "8000000", + "metadata": { + "displayName": "PIP Bytes In DDoS Threshold", + "description": "Threshold for the alert" + } + }, + "VNETDDOSAttackAlertSeverity": { + "type": "String", + "defaultValue": "1", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "VNET DDoS Attack Alert Severity", + "description": "Severity of the alert for VNET DDoS Attack" + } + }, + "VNETDDOSAttackWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "VNET DDoS Attack Window Size", + "description": "Window size for the alert" + } + }, + "VNETDDOSAttackEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "VNET DDoS Attack Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VNETDDOSAttackPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "VNET DDoS Attack Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "VNETDDOSAttackAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VNET DDoS Attack Alert State", + "description": "Alert state for the alert" + } + }, + "VNETDDOSAttackThreshold": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VNET DDoS Attack Threshold", + "description": "Threshold for the alert" + } + }, + "AGWApplicationGatewayTotalTimeAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "AGW Total Time Alert Severity", + "description": "Severity of the alert" + } + }, + "AGWApplicationGatewayTotalTimeAlertSensitivity": { + "type": "String", + "defaultValue": "Medium", + "allowedValues": [ + "Low", + "Medium", + "High" + ], + "metadata": { + "displayName": "AGW Total Time Dynamic Alert Sensitivity", + "description": "Dynamic Sensitivity of the alert" + } + }, + "AGWApplicationGatewayTotalTimeWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "AGW Total Time Window Size", + "description": "Window size for the alert" + } + }, + "AGWApplicationGatewayTotalTimeEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "AGW Total Time Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "AGWApplicationGatewayTotalTimePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "AGW Total Time Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "AGWApplicationGatewayTotalTimeAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "AGW Total Time Alert State", + "description": "Alert state for the alert" + } + }, + "AGWBackendLastByteResponseTimeAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "AGW Backend Last Byte Response Time Alert Severity", + "description": "Severity of the alert" + } + }, + "AGWBackendLastByteResponseTimeAlertSensitivity": { + "type": "String", + "defaultValue": "Medium", + "allowedValues": [ + "Low", + "Medium", + "High" + ], + "metadata": { + "displayName": "AGW Backend Last Byte Response Time Dynamic Alert Sensitivity", + "description": "Dynamic Severity of the alert" + } + }, + "AGWBackendLastByteResponseTimeWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "AGW Backend Last Byte Response Time Window Size", + "description": "Window size for the alert" + } + }, + "AGWBackendLastByteResponseTimeEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "AGW Backend Last Byte Response Time Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "AGWBackendLastByteResponseTimePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "AGW Backend Last Byte Response Time Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "AGWBackendLastByteResponseTimeAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "AGW Backend Last Byte Response Time Alert State", + "description": "Alert state for the alert" + } + }, + "AGWCapacityUnitsAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "AGW Capacity Units Alert Severity", + "description": "Severity of the alert" + } + }, + "AGWCapacityUnitsWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "AGW Capacity Units Window Size", + "description": "Window size for the alert" + } + }, + "AGWCapacityUnitsEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "AGW Capacity Units Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "AGWCapacityUnitsPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "AGW Capacity Units Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "AGWCapacityUnitsAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "AGW Capacity Units Alert State", + "description": "Alert state for the alert" + } + }, + "AGWComputeUnitsAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "AGW Compute Units Alert Severity", + "description": "Severity of the alert" + } + }, + "AGWComputeUnitsWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "AGW Compute Units Window Size", + "description": "Window size for the alert" + } + }, + "AGWComputeUnitsEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "AGW Compute Units Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "AGWComputeUnitsPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "AGW Compute Units Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "AGWComputeUnitsAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "AGW Compute Units Alert State", + "description": "Alert state for the alert" + } + }, + "AGWCPUUtilAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "AGW CPU Util Alert Severity", + "description": "Severity of the alert" + } + }, + "AGWCPUUtilWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "AGW CPU Util Window Size", + "description": "Window size for the alert" + } + }, + "AGWCPUUtilEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "AGW CPU Util Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "AGWCPUUtilPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "AGW CPU Util Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "AGWCPUUtilAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "AGW CPU Util Alert State", + "description": "Alert state for the alert" + } + }, + "AGWFailedRequestsAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "AGW Failed Requests Alert Severity", + "description": "Severity of the alert" + } + }, + "AGWFailedRequestsAlertSensitivity": { + "type": "String", + "defaultValue": "Medium", + "allowedValues": [ + "Low", + "Medium", + "High" + ], + "metadata": { + "displayName": "AGW Failed Requests Dynamic Alert Sensitivity", + "description": "Dynamic Sensitivity of the alert" + } + }, + "AGWFailedRequestsWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "AGW Failed Requests Window Size", + "description": "Window size for the alert" + } + }, + "AGWFailedRequestsEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "AGW Failed Requests Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "AGWFailedRequestsPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "AGW Failed Requests Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "AGWFailedRequestsAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "AGW Failed Requests Alert State", + "description": "Alert state for the alert" + } + }, + "AGWResponseStatusAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "AGW Response Status Alert Severity", + "description": "Severity of the alert" + } + }, + "AGWResponseStatusAlertSensitivity": { + "type": "String", + "defaultValue": "Medium", + "allowedValues": [ + "Low", + "Medium", + "High" + ], + "metadata": { + "displayName": "AGW Response Status Dynamic Alert Sensitivity", + "description": "Dynamic Sensitivity of the alert" + } + }, + "AGWResponseStatusWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "AGW Response Status Window Size", + "description": "Window size for the alert" + } + }, + "AGWResponseStatusEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "AGW Response Status Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "AGWResponseStatusPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "AGW Response Status Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "AGWResponseStatusAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "AGW Response Status Alert State", + "description": "Alert state for the alert" + } + }, + "AGWUnhealthyHostCountAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "AGW Unhealthy Host Count Alert Severity", + "description": "Severity of the alert" + } + }, + "AGWUnhealthyHostCountWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "AGW Unhealthy Host Count Window Size", + "description": "Window size for the alert" + } + }, + "AGWUnhealthyHostCountEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "AGW Unhealthy Host Count Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "AGWUnhealthyHostCountPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "AGW Unhealthy Host Count Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "AGWUnhealthyHostCountAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "AGW Unhealthy Host Count Alert State", + "description": "Alert state for the alert" + } + }, + "LBDatapathAvailabilityAlertSeverity": { + "type": "String", + "defaultValue": "0", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "LB Data path Availability Alert Severity", + "description": "Severity of the alert" + } + }, + "LBDatapathAvailabilityWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "LB Data path Availability Window Size", + "description": "Window size for the alert" + } + }, + "LBDatapathAvailabilityEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "LB Data path Availability Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "LBDatapathAvailabilityPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "LB Data path Availability Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "LBDatapathAvailabilityAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "LB Data path Availability Alert State", + "description": "Alert state for the alert" + } + }, + "LBGlobalBackendAvailabilityAlertSeverity": { + "type": "String", + "defaultValue": "0", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "LB Global Backend Availability Alert Severity", + "description": "Severity of the alert" + } + }, + "LBGlobalBackendAvailabilityWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "LB Global Backend Availability Window Size", + "description": "Window size for the alert" + } + }, + "LBGlobalBackendAvailabilityEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "LB Global Backend Availability Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "LBGlobalBackendAvailabilityPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "LB Global Backend Availability Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "LBGlobalBackendAvailabilityAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "LB Global Backend Availability Alert State", + "description": "Alert state for the alert" + } + }, + "LBHealthProbeStatusAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "LB Health Probe Status Alert Severity", + "description": "Severity of the alert" + } + }, + "LBHealthProbeStatusWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "LB Health Probe Status Window Size", + "description": "Window size for the alert" + } + }, + "LBHealthProbeStatusEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "LB Health Probe Status Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "LBHealthProbeStatusPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "LB Health Probe Status Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "LBHealthProbeStatusAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "LB Health Probe Status Alert State", + "description": "Alert state for the alert" + } + }, + "LBUsedSNATPortsAlertSeverity": { + "type": "String", + "defaultValue": "1", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "LB Used SNAT Ports Alert Severity", + "description": "Severity of the alert" + } + }, + "LBUsedSNATPortsWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "LB Used SNAT Ports Window Size", + "description": "Window size for the alert" + } + }, + "LBUsedSNATPortsEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "LB Used SNAT Ports Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "LBUsedSNATPortsPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "LB Used SNAT Ports Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "LBUsedSNATPortsAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "LB Used SNAT Ports Alert State", + "description": "Alert state for the alert" + } + }, + "CDNPOriginHealthPercentageAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "CDN Origin Health Percentage Alert Severity", + "description": "Severity of the alert" + } + }, + "CDNPOriginHealthPercentageWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "CDN Origin Health Percentage Window Size", + "description": "Window size for the alert" + } + }, + "CDNPOriginHealthPercentageEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "CDN Origin Health Percentage Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "CDNPOriginHealthPercentagePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "CDN Origin Health Percentage Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "CDNPOriginHealthPercentageAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "CDN Origin Health Percentage Alert State", + "description": "Alert state for the alert" + } + }, + "CDNPOriginLatencyAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "CDN Origin Latancy Alert Severity", + "description": "Severity of the alert" + } + }, + "CDNPOriginLatencyWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "CDN Origin Latency Window Size", + "description": "Window size for the alert" + } + }, + "CDNPOriginLatencyEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "CDN Origin Latency Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "CDNPOriginLatencyPolicyEffect": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "CDN Origin Latency Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "CDNPOriginLatencyAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "CDN Origin Latency Alert State", + "description": "Alert state for the alert" + } + }, + "CDNPPercentage4XXAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "CDN Percentage 4XX Alert Severity", + "description": "Severity of the alert" + } + }, + "CDNPPercentage4XXWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "CDN Percentage 4XX Window Size", + "description": "Window size for the alert" + } + }, + "CDNPPercentage4XXEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "CDN Percentage 4XX Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "CDNPPercentage4XXPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "CDN Percentage 4XX Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "CDNPPercentage4XXAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "CDN Percentage 4XX Alert State", + "description": "Alert state for the alert" + } + }, + "CDNPPercentage5XXAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "CDN Percentage 5XX Alert Severity", + "description": "Severity of the alert" + } + }, + "CDNPPercentage5XXWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "CDN Percentage 5XX Window Size", + "description": "Window size for the alert" + } + }, + "CDNPPercentage5XXEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "CDN Percentage 5XX Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "CDNPPercentage5XXPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "CDN Percentage 5XX Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "CDNPPercentage5XXAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "CDN Percentage 5XX Alert State", + "description": "Alert state for the alert" + } + }, + "TMEndpointHealthAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "TM Enpoint Health Alert Severity", + "description": "Severity of the alert" + } + }, + "TMEndpointHealthWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "TM Enpoint Health Window Size", + "description": "Window size for the alert" + } + }, + "TMEndpointHealthEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "TM Enpoint Health Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "TMEndpointHealthPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "TM Enpoint Health Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "TMEndpointHealthAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "TM Enpoint Health Alert State", + "description": "Alert state for the alert" + } + }, + "FDBackendHealthAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "FD Backend Health Alert Severity", + "description": "Severity of the alert" + } + }, + "FDBackendHealthWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "FD Backend Health Window Size", + "description": "Window size for the alert" + } + }, + "FDBackendHealthEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "FD Backend Health Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "FDBackendHealthPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "FD Backend Health Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "FDBackendHealthAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "FD Backend Health Alert State", + "description": "Alert state for the alert" + } + }, + "FDBackendRequestLatencyAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "FD Backend Request Latency Alert Severity", + "description": "Severity of the alert" + } + }, + "FDBackendRequestLatencyWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "FD Backend Request Latency Window Size", + "description": "Window size for the alert" + } + }, + "FDBackendRequestLatencyEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "FD Backend Request Latency Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "FDBackendRequestLatencyPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "FD Backend Request Latency Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "FDBackendRequestLatencyAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "FD Backend Request Latency Alert State", + "description": "Alert state for the alert" + } + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "ALZ_PIPBytesInDDoS", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_PublicIp_BytesInDDoSAttack_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('PIPBytesInDDoSAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('PIPBytesInDDoSWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('PIPBytesInDDoSEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('PIPBytesInDDoSPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('PIPBytesInDDoSAlertState')]" + }, + "threshold": { + "value": "[[[parameters('PIPBytesInDDoSThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_PIPDDoSAttack", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_PublicIp_DDoSAttack_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('PIPDDoSAttackAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('PIPDDoSAttackWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('PIPDDoSAttackEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('PIPDDoSAttackPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('PIPDDoSAttackAlertState')]" + }, + "threshold": { + "value": "[[[parameters('PIPDDoSAttackThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_PIPPacketsInDDoS", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_PublicIp_PacketsInDDoSAttack_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('PIPPacketsInDDoSAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('PIPPacketsInDDoSWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('PIPPacketsInDDoSEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('PIPPacketsInDDoSPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('PIPPacketsInDDoSAlertState')]" + }, + "threshold": { + "value": "[[[parameters('PIPPacketsInDDoSThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_PIPVIPAvailability", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_PublicIp_VIPAvailability_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('PIPVIPAvailabilityAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('PIPVIPAvailabilityWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('PIPVIPAvailabilityEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('PIPVIPAvailabilityPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('PIPVIPAvailabilityAlertState')]" + }, + "threshold": { + "value": "[[[parameters('PIPVIPAvailabilityThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VNETDDOSAttack", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VNET_DDoSAttack_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('VNETDDOSAttackAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('VNETDDOSAttackWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('VNETDDOSAttackEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('VNETDDOSAttackPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('VNETDDOSAttackAlertState')]" + }, + "threshold": { + "value": "[[[parameters('VNETDDOSAttackThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_AGWTotalTime", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_AG_ApplicationGatewayTotalTime_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('AGWApplicationGatewayTotalTimeAlertSeverity')]" + }, + "alertSensitivity": { + "value": "[[[parameters('AGWApplicationGatewayTotalTimeAlertSensitivity')]" + }, + "windowSize": { + "value": "[[[parameters('AGWApplicationGatewayTotalTimeWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('AGWApplicationGatewayTotalTimeEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('AGWApplicationGatewayTotalTimePolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('AGWApplicationGatewayTotalTimeAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_AGWBackendLastByteResponseTime", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_AG_BackendLastByteResponseTime_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('AGWBackendLastByteResponseTimeAlertSeverity')]" + }, + "alertSensitivity": { + "value": "[[[parameters('AGWBackendLastByteResponseTimeAlertSensitivity')]" + }, + "windowSize": { + "value": "[[[parameters('AGWBackendLastByteResponseTimeWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('AGWBackendLastByteResponseTimeEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('AGWBackendLastByteResponseTimePolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('AGWBackendLastByteResponseTimeAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_AGWCapacityUnits", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_AG_CapacityUnits_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('AGWCapacityUnitsAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('AGWCapacityUnitsWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('AGWCapacityUnitsEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('AGWCapacityUnitsPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('AGWCapacityUnitsAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_AGWComputeUnits", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_AG_ComputeUnits_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('AGWComputeUnitsAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('AGWComputeUnitsWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('AGWComputeUnitsEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('AGWComputeUnitsPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('AGWComputeUnitsAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_AGWCPUUtilization", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_AG_CPUUtilization_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('AGWCPUUtilAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('AGWCPUUtilWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('AGWCPUUtilEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('AGWCPUUtilPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('AGWCPUUtilAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_AGWFailedRequests", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_AG_FailedRequests_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('AGWFailedRequestsAlertSeverity')]" + }, + "alertSensitivity": { + "value": "[[[parameters('AGWFailedRequestsAlertSensitivity')]" + }, + "windowSize": { + "value": "[[[parameters('AGWFailedRequestsWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('AGWFailedRequestsEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('AGWFailedRequestsPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('AGWFailedRequestsAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_AGWResponseStatus", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_AG_ResponseStatus_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('AGWResponseStatusAlertSeverity')]" + }, + "alertSensitivity": { + "value": "[[[parameters('AGWResponseStatusAlertSensitivity')]" + }, + "windowSize": { + "value": "[[[parameters('AGWResponseStatusWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('AGWResponseStatusEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('AGWResponseStatusPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('AGWResponseStatusAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_AGWUnhealthyHostCount", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_AG_UnhealthyHostCount_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('AGWUnhealthyHostCountAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('AGWUnhealthyHostCountWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('AGWUnhealthyHostCountEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('AGWUnhealthyHostCountPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('AGWUnhealthyHostCountAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_LBDataPathAvailability", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ALB_DataPathAvailability_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('LBDataPathAvailabilityAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('LBDataPathAvailabilityWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('LBDataPathAvailabilityEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('LBDataPathAvailabilityPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('LBDataPathAvailabilityAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_LBGlobalBackendAvailability", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ALB_GlobalBackendAvailability_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('LBGlobalBackendAvailabilityAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('LBGlobalBackendAvailabilityWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('LBGlobalBackendAvailabilityEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('LBGlobalBackendAvailabilityPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('LBGlobalBackendAvailabilityAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_LBHealthProbeStatus", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ALB_HealthProbeStatus_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('LBHealthProbeStatusAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('LBHealthProbeStatusWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('LBHealthProbeStatusEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('LBHealthProbeStatusPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('LBHealthProbeStatusAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_LBUsedSNATPorts", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ALB_UsedSNATPorts_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('LBUsedSNATPortsAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('LBUsedSNATPortsWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('LBUsedSNATPortsEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('LBUsedSNATPortsPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('LBUsedSNATPortsAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_CDNPOriginHealthPercentage", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_FrontDoorCDN_OriginHealthPercentage_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('CDNPOriginHealthPercentageAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('CDNPOriginHealthPercentageWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('CDNPOriginHealthPercentageEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('CDNPOriginHealthPercentagePolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('CDNPOriginHealthPercentageAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_CDNPOriginLatency", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_FrontDoorCDN_OriginLatency_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('CDNPOriginLatencyAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('CDNPOriginLatencyWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('CDNPOriginLatencyEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('CDNPOriginLatencyPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('CDNPOriginLatencyAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_CDNPPercentage4XX", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_FrontDoorCDN_Percentage4XX_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('CDNPPercentage4XXAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('CDNPPercentage4XXWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('CDNPPercentage4XXEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('CDNPPercentage4XXPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('CDNPPercentage4XXAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_CDNPPercentage5XX", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_FrontDoorCDN_Percentage5XX_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('CDNPPercentage5XXAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('CDNPPercentage5XXWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('CDNPPercentage5XXEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('CDNPPercentage5XXPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('CDNPPercentage5XXAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_TMEndpointHealth", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_TM_EndpointHealth_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('TMEndpointHealthAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('TMEndpointHealthWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('TMEndpointHealthEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('TMEndpointHealthPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('TMEndpointHealthAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_FDBackendHealth", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_FD_BackendHealth_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('FDBackendHealthAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('FDBackendHealthWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('FDBackendHealthEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('FDBackendHealthPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('FDBackendHealthAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_FDBackendRequestLatency", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_FD_BackendRequestLatency_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('FDBackendRequestLatencyAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('FDBackendRequestLatencyWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('FDBackendRequestLatencyEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('FDBackendRequestLatencyPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('FDBackendRequestLatencyAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + } + ], + "policyType": "Custom", + "policyDefinitionGroups": null + } + }, + "$fxv#67": { + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "name": "Alerting-NetworkChanges", + "properties": { + "displayName": "Deploy Azure Monitor Baseline Alerts for Changes in Network Routing and Security", + "description": "This initiative implements Azure Monitor Baseline Alerts to monitor alterations in Network Routing and Security, such as modifications to Route Tables and the removal of Network Security Groups.", + "metadata": { + "version": "1.0.0", + "category": "Monitoring", + "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", + "alzCloudEnvironments": [ + "AzureCloud" + ], + "_deployed_by_amba": true + }, + "parameters": { + "ALZMonitorResourceGroupName": { + "type": "String", + "defaultValue": "ALZ-Monitoring-RG", + "metadata": { + "displayName": "ALZ Monitor Resource Group Name", + "description": "Name of the resource group where the ALZ Monitor resources will be deployed" + } + }, + "ALZMonitorResourceGroupTags": { + "type": "Object", + "defaultValue": { + "_deployed_by_alz_monitor": true + }, + "metadata": { + "displayName": "ALZ Monitor Resource Group Tags", + "description": "Tags for the resource group where the ALZ Monitor resources will be deployed" + } + }, + "ALZMonitorResourceGroupLocation": { + "type": "String", + "defaultValue": "centralus", + "metadata": { + "displayName": "ALZ Monitor Resource Group Location", + "description": "Location of the resource group where the ALZ Monitor resources will be deployed" + } + }, + "ALZMonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": "MonitorDisable" + }, + "ALZMonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] + }, + "activityNSGDeletePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Activity NSG Delete Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "activityNSGDeleteAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Activity NSG Delete Alert State", + "description": "Alert state for the alert" + } + }, + "activityUDRUpdatePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Activity UDR Update Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "activityUDRUpdateAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Activity UDR Update Alert State", + "description": "Alert state for the alert" + } + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "ALZ_activityNSGDelete", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_NSG_Delete", + "parameters": { + "effect": { + "value": "[[[parameters('activityNSGDeletePolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('activityNSGDeleteAlertState')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_activityUDRUpdate", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_RouteTable_Update", + "parameters": { + "effect": { + "value": "[[[parameters('activityUDRUpdatePolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('activityUDRUpdateAlertState')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + } + ], + "policyType": "Custom", + "policyDefinitionGroups": null + } + }, + "$fxv#7": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_ERGw_ExpressRouteBitsIn_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy ERG ExpressRoute Bits In Alert\",\n \"description\": \"Policy to audit/deploy ER Gateway Connection BitsInPerSecond Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Network\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"0\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"1\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"disabled\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/expressroutegateways\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Network/expressroutegateways\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"ERGatewayConnectionBitsInPerSecond\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/expressroutegateways/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\n \"equals\": \"LessThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-ERGatewayConnectionBitsInPerSecond-threshold-Override_'), field('tags._amba-ERGatewayConnectionBitsInPerSecond-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-GatewayERBitsInAlert')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for ER Gateway Connection BitsInPerSecond\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"ERGatewayConnectionBitsInPerSecond\",\n \"metricNamespace\": \"Microsoft.Network/expressroutegateways\",\n \"metricName\": \"ERGatewayConnectionBitsInPerSecond\",\n \"operator\": \"LessThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-ERGatewayConnectionBitsInPerSecond-threshold-Override_'), field('tags._amba-ERGatewayConnectionBitsInPerSecond-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#8": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_ERGw_ExpressRouteBitsOut_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy ERG ExpressRoute Bits Out Alert\",\n \"description\": \"Policy to audit/deploy ER Gateway Connection BitsOutPerSecond Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Network\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"0\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"1\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"disabled\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/expressroutegateways\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Network/expressroutegateways\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"ERGatewayConnectionBitsOutPerSecond\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/expressroutegateways/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\n \"equals\": \"LessThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-ERGatewayConnectionBitsOutPerSecond-threshold-Override_'), field('tags._amba-ERGatewayConnectionBitsOutPerSecond-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-GatewayERBitsOutAlert')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for ER Gateway Connection BitsOutPerSecond\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"ERGatewayConnectionBitsOutPerSecond\",\n \"metricNamespace\": \"Microsoft.Network/expressroutegateways\",\n \"metricName\": \"ERGatewayConnectionBitsOutPerSecond\",\n \"operator\": \"LessThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-ERGatewayConnectionBitsOutPerSecond-threshold-Override_'), field('tags._amba-ERGatewayConnectionBitsOutPerSecond-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#9": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_ERGw_ExpressRouteCpuUtil_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy ERG ExpressRoute CPU Utilization Alert\",\n \"description\": \"Policy to audit/deploy ER Gateway Express Route CPU Utilization Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Network\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"1\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT1M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"80\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Network/expressroutegateways\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Network/expressroutegateways\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"ExpressRouteGatewayCpuUtilization\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/expressroutegateways/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\n \"equals\": \"GreaterThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-ExpressRouteGatewayCpuUtilization-threshold-Override_'), field('tags._amba-ExpressRouteGatewayCpuUtilization-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-GatewayERCPUAlert')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for ER Gateway Express Route CPU Utilization\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"ExpressRouteGatewayCpuUtilization\",\n \"metricNamespace\": \"Microsoft.Network/expressroutegateways\",\n \"metricName\": \"ExpressRouteGatewayCpuUtilization\",\n \"operator\": \"GreaterThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-ExpressRouteGatewayCpuUtilization-threshold-Override_'), field('tags._amba-ExpressRouteGatewayCpuUtilization-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "cloudEnv": "[environment().name]", + "defaultDeploymentLocationByCloudType": { + "AzureCloud": "northeurope", + "AzureChinaCloud": "chinaeast2", + "AzureUSGovernment": "usgovvirginia" + }, + "templateVars": { + "scope": "/providers/Microsoft.Management/managementGroups/contoso", + "defaultDeploymentLocation": "\"location\": \"northeurope\"", + "localizedDeploymentLocation": "[format('\"location\": \"{0}\"', variables('defaultDeploymentLocationByCloudType')[variables('cloudEnv')])]" + }, + "targetDeploymentLocationByCloudType": { + "AzureCloud": "[coalesce(parameters('location'), 'northeurope')]", + "AzureChinaCloud": "[coalesce(parameters('location'), 'chinaeast2')]", + "AzureUSGovernment": "[coalesce(parameters('location'), 'usgovvirginia')]" + }, + "deploymentLocation": "[format('\"location\": \"{0}\"', variables('targetDeploymentLocationByCloudType')[variables('cloudEnv')])]", + "loadPolicyDefinitions": { + "All": [ + "[variables('$fxv#0')]", + "[variables('$fxv#1')]", + "[variables('$fxv#2')]", + "[variables('$fxv#3')]", + "[variables('$fxv#4')]", + "[variables('$fxv#5')]", + "[variables('$fxv#6')]", + "[variables('$fxv#7')]", + "[variables('$fxv#8')]", + "[variables('$fxv#9')]", + "[variables('$fxv#10')]", + "[variables('$fxv#11')]", + "[variables('$fxv#12')]", + "[variables('$fxv#13')]", + "[variables('$fxv#14')]", + "[variables('$fxv#15')]", + "[variables('$fxv#16')]", + "[variables('$fxv#17')]", + "[variables('$fxv#18')]", + "[variables('$fxv#19')]", + "[variables('$fxv#20')]", + "[variables('$fxv#21')]", + "[variables('$fxv#22')]", + "[variables('$fxv#23')]", + "[variables('$fxv#24')]", + "[variables('$fxv#25')]", + "[variables('$fxv#26')]", + "[variables('$fxv#27')]", + "[variables('$fxv#28')]", + "[variables('$fxv#29')]", + "[variables('$fxv#30')]", + "[variables('$fxv#31')]", + "[variables('$fxv#32')]", + "[variables('$fxv#33')]", + "[variables('$fxv#34')]", + "[variables('$fxv#35')]", + "[variables('$fxv#36')]", + "[variables('$fxv#37')]", + "[variables('$fxv#38')]", + "[variables('$fxv#39')]", + "[variables('$fxv#40')]", + "[variables('$fxv#41')]", + "[variables('$fxv#42')]", + "[variables('$fxv#43')]", + "[variables('$fxv#44')]", + "[variables('$fxv#45')]", + "[variables('$fxv#46')]", + "[variables('$fxv#47')]", + "[variables('$fxv#48')]", + "[variables('$fxv#49')]", + "[variables('$fxv#50')]", + "[variables('$fxv#51')]", + "[variables('$fxv#52')]", + "[variables('$fxv#53')]", + "[variables('$fxv#54')]", + "[variables('$fxv#55')]", + "[variables('$fxv#56')]", + "[variables('$fxv#57')]", + "[variables('$fxv#58')]", + "[variables('$fxv#59')]", + "[variables('$fxv#60')]", + "[variables('$fxv#61')]", + "[variables('$fxv#62')]", + "[variables('$fxv#63')]", + "[variables('$fxv#64')]" + ], + "AzureCloud": [], + "AzureChinaCloud": [], + "AzureUSGovernment": [] + }, + "loadPolicySetDefinitions": { + "All": [ + "[string(variables('$fxv#65'))]", + "[string(variables('$fxv#66'))]", + "[string(variables('$fxv#67'))]" + ], + "AzureCloud": [], + "AzureChinaCloud": [], + "AzureUSGovernment": [] + }, + "policyDefinitionsByCloudType": { + "All": "[variables('policyDefinitionsAll')]", + "AzureCloud": "[variables('policyDefinitionsAzureCloud')]", + "AzureChinaCloud": "[variables('policyDefinitionsAzureChinaCloud')]", + "AzureUSGovernment": "[variables('policyDefinitionsAzureUSGovernment')]" + }, + "policySetDefinitionsByCloudType": { + "All": "[variables('policySetDefinitionsAll')]", + "AzureCloud": "[variables('policySetDefinitionsAzureCloud')]", + "AzureChinaCloud": "[variables('policySetDefinitionsAzureChinaCloud')]", + "AzureUSGovernment": "[variables('policySetDefinitionsAzureUSGovernment')]" + }, + "policyDefinitions": "[concat(variables('policyDefinitionsByCloudType').All, variables('policyDefinitionsByCloudType')[variables('cloudEnv')])]", + "policySetDefinitions": "[concat(variables('policySetDefinitionsByCloudType').All, variables('policySetDefinitionsByCloudType')[variables('cloudEnv')])]" + }, + "resources": [ + { + "copy": { + "name": "PolicyDefinitions", + "count": "[length(variables('policyDefinitions'))]" + }, + "type": "Microsoft.Authorization/policyDefinitions", + "apiVersion": "2020-09-01", + "name": "[variables('policyDefinitions')[copyIndex()].name]", + "properties": { + "description": "[variables('policyDefinitions')[copyIndex()].properties.description]", + "displayName": "[variables('policyDefinitions')[copyIndex()].properties.displayName]", + "metadata": "[variables('policyDefinitions')[copyIndex()].properties.metadata]", + "mode": "[variables('policyDefinitions')[copyIndex()].properties.mode]", + "parameters": "[variables('policyDefinitions')[copyIndex()].properties.parameters]", + "policyType": "[variables('policyDefinitions')[copyIndex()].properties.policyType]", + "policyRule": "[variables('policyDefinitions')[copyIndex()].properties.policyRule]" + } + }, + { + "copy": { + "name": "PolicySetDefinitions", + "count": "[length(variables('policySetDefinitions'))]" + }, + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2020-09-01", + "name": "[variables('policySetDefinitions')[copyIndex()].name]", + "properties": { + "description": "[variables('policySetDefinitions')[copyIndex()].properties.description]", + "displayName": "[variables('policySetDefinitions')[copyIndex()].properties.displayName]", + "metadata": "[variables('policySetDefinitions')[copyIndex()].properties.metadata]", + "parameters": "[variables('policySetDefinitions')[copyIndex()].properties.parameters]", + "policyType": "[variables('policySetDefinitions')[copyIndex()].properties.policyType]", + "policyDefinitions": "[variables('policySetDefinitions')[copyIndex()].properties.policyDefinitions]", + "policyDefinitionGroups": "[variables('policySetDefinitions')[copyIndex()].properties.policyDefinitionGroups]" + }, + "dependsOn": [ + "PolicyDefinitions" + ] + } + ], + "outputs": { + "policyDefinitionNames": { + "type": "array", + "copy": { + "count": "[length(variables('policyDefinitions'))]", + "input": "[variables('policyDefinitions')[copyIndex()].name]" + } + }, + "policySetDefinitionNames": { + "type": "array", + "copy": { + "count": "[length(variables('policySetDefinitions'))]", + "input": "[variables('policySetDefinitions')[copyIndex()].name]" + } + } + } +} \ No newline at end of file diff --git a/patterns/alz/policyDefinitions/policies-NotificationAssets.json b/patterns/alz/policyDefinitions/policies-NotificationAssets.json new file mode 100644 index 000000000..b86f4a836 --- /dev/null +++ b/patterns/alz/policyDefinitions/policies-NotificationAssets.json @@ -0,0 +1,449 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-08-01/managementGroupDeploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.29.47.4906", + "templateHash": "12245342858017362291" + } + }, + "parameters": { + "topLevelManagementGroupPrefix": { + "type": "string", + "defaultValue": "alz", + "metadata": { + "message": "The JSON version of this file is programatically generated from Bicep. PLEASE DO NOT UPDATE MANUALLY!!", + "description": "Provide a prefix (unique at tenant-scope) for the Management Group hierarchy and other resources created as part of an Azure landing zone. DEFAULT VALUE = \"alz\"" + } + }, + "location": { + "type": "string", + "defaultValue": "[deployment().location]", + "metadata": { + "description": "Optionally set the deployment location for policies with Deploy If Not Exists effect. DEFAULT VALUE = \"deployment().location\"" + } + }, + "scope": { + "type": "string", + "defaultValue": "[tenantResourceId('Microsoft.Management/managementGroups', parameters('topLevelManagementGroupPrefix'))]", + "metadata": { + "description": "Optionally set the scope for custom Policy Definitions used in Policy Set Definitions (Initiatives). Must be one of '/', '/subscriptions/id' or '/providers/Microsoft.Management/managementGroups/id'. DEFAULT VALUE = '/providers/Microsoft.Management/managementGroups/${topLevelManagementGroupPrefix}'" + } + } + }, + "variables": { + "copy": [ + { + "name": "processPolicyDefinitionsAll", + "count": "[length(variables('loadPolicyDefinitions').All)]", + "input": "[replace(replace(variables('loadPolicyDefinitions').All[copyIndex('processPolicyDefinitionsAll')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" + }, + { + "name": "processPolicyDefinitionsAzureCloud", + "count": "[length(variables('loadPolicyDefinitions').AzureCloud)]", + "input": "[replace(replace(variables('loadPolicyDefinitions').AzureCloud[copyIndex('processPolicyDefinitionsAzureCloud')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" + }, + { + "name": "processPolicyDefinitionsAzureChinaCloud", + "count": "[length(variables('loadPolicyDefinitions').AzureChinaCloud)]", + "input": "[replace(replace(variables('loadPolicyDefinitions').AzureChinaCloud[copyIndex('processPolicyDefinitionsAzureChinaCloud')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" + }, + { + "name": "processPolicyDefinitionsAzureUSGovernment", + "count": "[length(variables('loadPolicyDefinitions').AzureUSGovernment)]", + "input": "[replace(replace(variables('loadPolicyDefinitions').AzureUSGovernment[copyIndex('processPolicyDefinitionsAzureUSGovernment')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" + }, + { + "name": "processPolicySetDefinitionsAll", + "count": "[length(variables('loadPolicySetDefinitions').All)]", + "input": "[replace(variables('loadPolicySetDefinitions').All[copyIndex('processPolicySetDefinitionsAll')], variables('templateVars').scope, parameters('scope'))]" + }, + { + "name": "processPolicySetDefinitionsAzureCloud", + "count": "[length(variables('loadPolicySetDefinitions').AzureCloud)]", + "input": "[replace(variables('loadPolicySetDefinitions').AzureCloud[copyIndex('processPolicySetDefinitionsAzureCloud')], variables('templateVars').scope, parameters('scope'))]" + }, + { + "name": "processPolicySetDefinitionsAzureChinaCloud", + "count": "[length(variables('loadPolicySetDefinitions').AzureChinaCloud)]", + "input": "[replace(variables('loadPolicySetDefinitions').AzureChinaCloud[copyIndex('processPolicySetDefinitionsAzureChinaCloud')], variables('templateVars').scope, parameters('scope'))]" + }, + { + "name": "processPolicySetDefinitionsAzureUSGovernment", + "count": "[length(variables('loadPolicySetDefinitions').AzureUSGovernment)]", + "input": "[replace(variables('loadPolicySetDefinitions').AzureUSGovernment[copyIndex('processPolicySetDefinitionsAzureUSGovernment')], variables('templateVars').scope, parameters('scope'))]" + }, + { + "name": "policyDefinitionsAll", + "count": "[length(variables('processPolicyDefinitionsAll'))]", + "input": "[json(variables('processPolicyDefinitionsAll')[copyIndex('policyDefinitionsAll')])]" + }, + { + "name": "policyDefinitionsAzureCloud", + "count": "[length(variables('processPolicyDefinitionsAzureCloud'))]", + "input": "[json(variables('processPolicyDefinitionsAzureCloud')[copyIndex('policyDefinitionsAzureCloud')])]" + }, + { + "name": "policyDefinitionsAzureChinaCloud", + "count": "[length(variables('processPolicyDefinitionsAzureChinaCloud'))]", + "input": "[json(variables('processPolicyDefinitionsAzureChinaCloud')[copyIndex('policyDefinitionsAzureChinaCloud')])]" + }, + { + "name": "policyDefinitionsAzureUSGovernment", + "count": "[length(variables('processPolicyDefinitionsAzureUSGovernment'))]", + "input": "[json(variables('processPolicyDefinitionsAzureUSGovernment')[copyIndex('policyDefinitionsAzureUSGovernment')])]" + }, + { + "name": "policySetDefinitionsAll", + "count": "[length(variables('processPolicySetDefinitionsAll'))]", + "input": "[json(variables('processPolicySetDefinitionsAll')[copyIndex('policySetDefinitionsAll')])]" + }, + { + "name": "policySetDefinitionsAzureCloud", + "count": "[length(variables('processPolicySetDefinitionsAzureCloud'))]", + "input": "[json(variables('processPolicySetDefinitionsAzureCloud')[copyIndex('policySetDefinitionsAzureCloud')])]" + }, + { + "name": "policySetDefinitionsAzureChinaCloud", + "count": "[length(variables('processPolicySetDefinitionsAzureChinaCloud'))]", + "input": "[json(variables('processPolicySetDefinitionsAzureChinaCloud')[copyIndex('policySetDefinitionsAzureChinaCloud')])]" + }, + { + "name": "policySetDefinitionsAzureUSGovernment", + "count": "[length(variables('processPolicySetDefinitionsAzureUSGovernment'))]", + "input": "[json(variables('processPolicySetDefinitionsAzureUSGovernment')[copyIndex('policySetDefinitionsAzureUSGovernment')])]" + } + ], + "$fxv#0": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_AlertProcessing_Rule\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy AMBA Notification Assets\",\n \"description\": \"Policy to deploy Action Group and Alert Processing Rule for all AMBA alerts\",\n \"metadata\": {\n \"version\": \"1.3.0\",\n \"category\": \"Monitoring\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"ALZMonitorResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"ALZMonitorResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"_deployed_by_amba\": true\n }\n },\n \"ALZMonitorResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"ALZMonitorActionGroupEmail\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"Action Group Email Addresses\",\n \"description\": \"Email addresses to send alerts to\"\n },\n \"defaultValue\": []\n },\n \"ALZLogicappResourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Logic App Resource Id\",\n \"description\": \"Logic App Resource Id for Action Group to send alerts to\"\n },\n \"defaultValue\": \"\"\n },\n \"ALZLogicappCallbackUrl\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Logic App Callback URL\",\n \"description\": \"Callback URL that triggers the Logic App\"\n },\n \"defaultValue\": \"\"\n },\n \"ALZArmRoleId\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Arm Role Ids\",\n \"description\": \"Arm Built-in Role Ids for action group to send alerts to\"\n },\n \"defaultValue\": []\n },\n \"ALZEventHubResourceId\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Event Hub resource Ids\",\n \"description\": \"Event Hub resource Ids for action group to send alerts to\"\n },\n \"defaultValue\": []\n },\n \"ALZWebhookServiceUri\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"Webhook Service Uri(s)\",\n \"description\": \"Indicates the service uri(s) of the webhook to send alerts to\"\n },\n \"defaultValue\": []\n },\n \"ALZFunctionResourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Function Resource Id\",\n \"description\": \"Function Resource Id for Action Group to send alerts to\"\n },\n \"defaultValue\": \"\"\n },\n \"ALZFunctionTriggerUrl\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Function Trigger URL\",\n \"description\": \"URL that triggers the Function\"\n },\n \"defaultValue\": \"\"\n },\n \"BYOActionGroup\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Customer defined Action Group Resource IDs\",\n \"description\": \"The Resource IDs of existing Action Groups currently deployed in the environment.\"\n },\n \"defaultValue\": []\n },\n \"BYOAlertProcessingRule\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Customer defined Alert Processing Rule Resource ID\",\n \"description\": \"The Resource ID of an existing Alert Processing Rule already deployed by the customer in his environment\"\n },\n \"defaultValue\": \"\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Resources/subscriptions\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n },\n {\n \"value\": \"[[empty(parameters('BYOAlertProcessingRule'))]\",\n \"equals\": \"true\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"deployIfNotExists\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.AlertsManagement/actionRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('ALZMonitorResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.AlertsManagement/actionRules/description\",\n \"equals\": \"AMBA Notification Assets - Alert Processing Rule for Subscription\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"ALZMonitorResourceGroupName\": {\n \"type\": \"string\"\n },\n \"ALZMonitorResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"ALZMonitorResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"ALZMonitorActionGroupEmail\": {\n \"type\": \"Array\"\n },\n \"ALZLogicappResourceId\": {\n \"type\": \"string\"\n },\n \"ALZLogicappCallbackUrl\": {\n \"type\": \"String\"\n },\n \"ALZArmRoleId\": {\n \"type\": \"array\"\n },\n \"ALZEventHubResourceId\": {\n \"type\": \"array\"\n },\n \"ALZWebhookServiceUri\": {\n \"type\": \"Array\"\n },\n \"ALZFunctionResourceId\": {\n \"type\": \"string\"\n },\n \"ALZFunctionTriggerUrl\": {\n \"type\": \"String\"\n },\n \"BYOActionGroup\": {\n \"type\": \"array\"\n },\n \"BYOAlertProcessingRule\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {\n \"varBYOAlertProcessingRule\": \"[[if(empty(parameters('BYOAlertProcessingRule')), null(), trim(parameters('BYOAlertProcessingRule')))]\",\n \"varLogicAppReceivers\": [\n {\n \"name\": \"AlzLA-0\",\n \"resourceId\": \"[[if(empty(parameters('ALZLogicappResourceId')), null(), trim(parameters('ALZLogicappResourceId')))]\",\n \"callbackUrl\": \"[[if(empty(parameters('ALZLogicappCallbackUrl')), null(), trim(parameters('ALZLogicappCallbackUrl')))]\",\n \"useCommonSchema\": true\n }\n ],\n \"varAzureFunctionReceivers\": [\n {\n \"name\": \"AlzFa-0\",\n \"functionAppResourceId\": \"[[if(empty(parameters('ALZFunctionResourceId')), null(), split(trim(parameters('ALZFunctionResourceId')),'/functions/')[0])]\",\n \"functionName\": \"[[if(empty(parameters('ALZFunctionResourceId')), null(), split(trim(parameters('ALZFunctionResourceId')),'/')[10])]\",\n \"httpTriggerUrl\": \"[[if(empty(parameters('ALZFunctionTriggerUrl')), null(), trim(parameters('ALZFunctionTriggerUrl')))]\",\n \"useCommonAlertSchema\": true\n }\n ],\n \"copy\": [\n {\n \"name\": \"varEmailReceivers\",\n \"count\": \"[[length(parameters('ALZMonitorActionGroupEmail'))]\",\n \"mode\": \"serial\",\n \"input\": {\n \"name\": \"[[concat('AlzMail-', indexOf(parameters('ALZMonitorActionGroupEmail'), parameters('ALZMonitorActionGroupEmail')[copyIndex('varEmailReceivers')]))]\",\n \"emailAddress\": \"[[trim(parameters('ALZMonitorActionGroupEmail')[copyIndex('varEmailReceivers')])]\",\n \"useCommonSchema\": true\n }\n },\n {\n \"name\": \"varArmRoleReceivers\",\n \"count\": \"[[length(parameters('ALZArmRoleId'))]\",\n \"mode\": \"serial\",\n \"input\": {\n \"name\": \"[[concat('AlzARM-', indexOf(parameters('ALZArmRoleId'), parameters('ALZArmRoleId')[copyIndex('varArmRoleReceivers')]))]\",\n \"roleId\": \"[[trim(parameters('ALZArmRoleId')[copyIndex('varArmRoleReceivers')])]\",\n \"useCommonSchema\": true\n }\n },\n {\n \"name\": \"varEventHubReceivers\",\n \"count\": \"[[length(parameters('ALZEventHubResourceId'))]\",\n \"mode\": \"serial\",\n \"input\": {\n \"name\": \"[[concat('AlzEH-', indexOf(parameters('ALZEventHubResourceId'), parameters('ALZEventHubResourceId')[copyIndex('varEventHubReceivers')]))]\",\n \"subscriptionId\": \"[[if(empty(parameters('ALZEventHubResourceId')), null(), split(trim(parameters('ALZEventHubResourceId')[copyIndex('varEventHubReceivers')]),'/')[2])]\",\n \"eventHubNameSpace\": \"[[if(empty(parameters('ALZEventHubResourceId')), null(), split(trim(parameters('ALZEventHubResourceId')[copyIndex('varEventHubReceivers')]),'/')[8])]\",\n \"eventHubName\": \"[[if(empty(parameters('ALZEventHubResourceId')), null(), split(trim(parameters('ALZEventHubResourceId')[copyIndex('varEventHubReceivers')]),'/')[10])]\",\n \"useCommonAlertSchema\": true,\n \"tenantId\": \"[[subscription().tenantId]\"\n }\n },\n {\n \"name\": \"varWebhookReceivers\",\n \"count\": \"[[length(parameters('ALZWebhookServiceUri'))]\",\n \"mode\": \"serial\",\n \"input\": {\n \"name\": \"[[concat('AlzWh-', indexOf(parameters('ALZWebhookServiceUri'), parameters('ALZWebhookServiceUri')[copyIndex('varWebhookReceivers')]))]\",\n \"identifierUri\": \"null()\",\n \"objectId\": \"null()\",\n \"serviceUri\": \"[[trim(parameters('ALZWebhookServiceUri')[copyIndex('varWebhookReceivers')])]\",\n \"useCommonAlertSchema\": true,\n \"tenantId\": \"null()\",\n \"useAadAuth\": \"false\"\n }\n },\n {\n \"name\": \"varAGIds\",\n \"count\": \"[[length(parameters('BYOActionGroup'))]\",\n \"mode\": \"serial\",\n \"input\": \"[[trim(parameters('BYOActionGroup')[copyIndex('varAGIds')])]\"\n }\n ]\n },\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('ALZMonitorResourceGroupName')]\",\n \"location\": \"[[parameters('ALZMonitorResourceGroupLocation')]\",\n \"tags\": \"[[parameters('ALZMonitorResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"ActionGroupDeployment\",\n \"resourceGroup\": \"[[parameters('ALZMonitorResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('ALZMonitorResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"ALZMonitorResourceGroupName\": {\n \"type\": \"string\"\n },\n \"ALZMonitorActionGroupEmail\": {\n \"type\": \"Array\"\n },\n \"ALZLogicappResourceId\": {\n \"type\": \"string\"\n },\n \"ALZLogicappCallbackUrl\": {\n \"type\": \"string\"\n },\n \"ALZArmRoleId\": {\n \"type\": \"array\"\n },\n \"ALZEventHubResourceId\": {\n \"type\": \"array\"\n },\n \"ALZWebhookServiceUri\": {\n \"type\": \"Array\"\n },\n \"ALZFunctionResourceId\": {\n \"type\": \"string\"\n },\n \"ALZFunctionTriggerUrl\": {\n \"type\": \"string\"\n },\n \"BYOActionGroup\": {\n \"type\": \"array\"\n },\n \"BYOAlertProcessingRule\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"condition\": \"[[and(empty(parameters('BYOActionGroup')), empty(parameters('BYOAlertProcessingRule')))]\",\n \"type\": \"Microsoft.Insights/actionGroups\",\n \"apiVersion\": \"2023-01-01\",\n \"name\": \"[[concat('ag-AMBA-', subscription().displayName, '-001')]\",\n \"location\": \"Global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"groupShortName\": \"ActGrp\",\n \"enabled\": true,\n \"emailReceivers\": \"[[if(empty(parameters('ALZMonitorActionGroupEmail')), null(), variables('varEmailReceivers'))]\",\n \"armRoleReceivers\": \"[[if(empty(parameters('ALZArmRoleId')), null(), variables('varArmRoleReceivers'))]\",\n \"logicAppReceivers\": \"[[if(empty(parameters('ALZLogicappResourceId')), null(), variables('varLogicAppReceivers'))]\",\n \"eventHubReceivers\": \"[[if(empty(parameters('ALZEventHubResourceId')), null(), variables('varEventHubReceivers'))]\",\n \"webhookReceivers\": \"[[if(empty(parameters('ALZWebhookServiceUri')), null(), variables('varWebhookReceivers'))]\",\n \"azureFunctionReceivers\": \"[[if(empty(parameters('ALZFunctionResourceId')), null(), variables('varAzureFunctionReceivers'))]\"\n }\n },\n {\n \"condition\": \"[[empty(parameters('BYOAlertProcessingRule'))]\",\n \"type\": \"Microsoft.AlertsManagement/actionRules\",\n \"apiVersion\": \"2021-08-08\",\n \"name\": \"[[concat('apr-AMBA-',subscription().displayName, '-001')]\",\n \"location\": \"Global\",\n \"dependsOn\": [\n \"[[concat('ag-AMBA-', subscription().displayName, '-001')]\"\n ],\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"description\": \"AMBA Notification Assets - Alert Processing Rule for Subscription\",\n \"enabled\": true,\n \"actions\": [\n {\n \"actiongroupIds\": \"[[if(empty(parameters('BYOActionGroup')), array(concat(subscription().Id, '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/microsoft.insights/actionGroups/', 'ag-AMBA-', subscription().displayName, '-001')), variables('varAGIds'))]\",\n \"actionType\": \"AddActionGroups\"\n }\n ]\n }\n }\n ]\n },\n \"parameters\": {\n \"ALZMonitorResourceGroupName\": {\n \"value\": \"[[parameters('ALZMonitorResourceGroupName')]\"\n },\n \"ALZMonitorActionGroupEmail\": {\n \"value\": \"[[parameters('ALZMonitorActionGroupEmail')]\"\n },\n \"ALZLogicappResourceId\": {\n \"value\": \"[[parameters('ALZLogicappResourceId')]\"\n },\n \"ALZLogicappCallbackUrl\": {\n \"value\": \"[[parameters('ALZLogicappCallbackUrl')]\"\n },\n \"ALZArmRoleId\": {\n \"value\": \"[[parameters('ALZArmRoleId')]\"\n },\n \"ALZEventHubResourceId\": {\n \"value\": \"[[parameters('ALZEventHubResourceId')]\"\n },\n \"ALZWebhookServiceUri\": {\n \"value\": \"[[parameters('ALZWebhookServiceUri')]\"\n },\n \"ALZFunctionResourceId\": {\n \"value\": \"[[parameters('ALZFunctionResourceId')]\"\n },\n \"ALZFunctionTriggerUrl\": {\n \"value\": \"[[parameters('ALZFunctionTriggerUrl')]\"\n },\n \"BYOActionGroup\": {\n \"value\": \"[[parameters('BYOActionGroup')]\"\n },\n \"BYOAlertProcessingRule\": {\n \"value\": \"[[parameters('BYOAlertProcessingRule')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"ALZMonitorResourceGroupName\": {\n \"value\": \"[[parameters('ALZMonitorResourceGroupName')]\"\n },\n \"ALZMonitorResourceGroupTags\": {\n \"value\": \"[[parameters('ALZMonitorResourceGroupTags')]\"\n },\n \"ALZMonitorResourceGroupLocation\": {\n \"value\": \"[[parameters('ALZMonitorResourceGroupLocation')]\"\n },\n \"ALZMonitorActionGroupEmail\": {\n \"value\": \"[[parameters('ALZMonitorActionGroupEmail')]\"\n },\n \"ALZLogicappResourceId\": {\n \"value\": \"[[parameters('ALZLogicappResourceId')]\"\n },\n \"ALZLogicappCallbackUrl\": {\n \"value\": \"[[parameters('ALZLogicappCallbackUrl')]\"\n },\n \"ALZArmRoleId\": {\n \"value\": \"[[parameters('ALZArmRoleId')]\"\n },\n \"ALZEventHubResourceId\": {\n \"value\": \"[[parameters('ALZEventHubResourceId')]\"\n },\n \"ALZWebhookServiceUri\": {\n \"value\": \"[[parameters('ALZWebhookServiceUri')]\"\n },\n \"ALZFunctionResourceId\": {\n \"value\": \"[[parameters('ALZFunctionResourceId')]\"\n },\n \"ALZFunctionTriggerUrl\": {\n \"value\": \"[[parameters('ALZFunctionTriggerUrl')]\"\n },\n \"BYOActionGroup\": {\n \"value\": \"[[parameters('BYOActionGroup')]\"\n },\n \"BYOAlertProcessingRule\": {\n \"value\": \"[[parameters('BYOAlertProcessingRule')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#1": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_Suppression_AlertProcessing_Rule\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy AMBA Notification Suppression Asset\",\n \"description\": \"Policy to deploy empty and disabled suppression Alert Processing Rule for all AMBA alerts\",\n \"metadata\": {\n \"version\": \"1.1.0\",\n \"category\": \"Monitoring\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"ALZMonitorResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"ALZMonitorResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"_deployed_by_amba\": true\n }\n },\n \"ALZMonitorResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Resources/subscriptions\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"deployIfNotExists\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.AlertsManagement/actionRules\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('ALZMonitorResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.AlertsManagement/actionRules/description\",\n \"equals\": \"AMBA Notification Assets - Suppression Alert Processing Rule for maintenance period for Subscription\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"ALZMonitorResourceGroupName\": {\n \"type\": \"string\"\n },\n \"ALZMonitorResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"ALZMonitorResourceGroupLocation\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('ALZMonitorResourceGroupName')]\",\n \"location\": \"[[parameters('ALZMonitorResourceGroupLocation')]\",\n \"tags\": \"[[parameters('ALZMonitorResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"SuppressionRuleDeployment\",\n \"resourceGroup\": \"[[parameters('ALZMonitorResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('ALZMonitorResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"ALZMonitorResourceGroupName\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.AlertsManagement/actionRules\",\n \"apiVersion\": \"2021-08-08\",\n \"name\": \"[[concat('apr-AMBA-',subscription().displayName, '-002')]\",\n \"location\": \"Global\",\n \"dependsOn\": [],\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"scopes\": [\n \"[[subscription().Id]\"\n ],\n \"description\": \"AMBA Notification Assets - Suppression Alert Processing Rule for maintenance period for Subscription\",\n \"enabled\": false,\n \"actions\": [\n {\n \"actionType\": \"RemoveAllActionGroups\"\n }\n ]\n }\n }\n ]\n },\n \"parameters\": {\n \"ALZMonitorResourceGroupName\": {\n \"value\": \"[[parameters('ALZMonitorResourceGroupName')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"ALZMonitorResourceGroupName\": {\n \"value\": \"[[parameters('ALZMonitorResourceGroupName')]\"\n },\n \"ALZMonitorResourceGroupTags\": {\n \"value\": \"[[parameters('ALZMonitorResourceGroupTags')]\"\n },\n \"ALZMonitorResourceGroupLocation\": {\n \"value\": \"[[parameters('ALZMonitorResourceGroupLocation')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#2": { + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "name": "Notification-Assets", + "properties": { + "displayName": "Deploy Azure Monitor Baseline Alerts - Notification Assets", + "description": "This initiative deploys Notification Assets for Azure Monitor Baseline Alerts. This includes the setup of an Alert Processing Rule and an Action Group to manage notifications and actions, along with a Notification Suppression Rule to manage alert notifications, as well as a Notification Suppression Rule to control alert notifications.", + "metadata": { + "version": "1.3.0", + "category": "Monitoring", + "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", + "alzCloudEnvironments": [ + "AzureCloud" + ], + "_deployed_by_amba": true + }, + "parameters": { + "ALZMonitorResourceGroupName": { + "type": "String", + "defaultValue": "ALZ-Monitoring-RG", + "metadata": { + "displayName": "Resource Group Name", + "description": "Name of the resource group to deploy the alerts to" + } + }, + "ALZMonitorResourceGroupTags": { + "type": "Object", + "defaultValue": { + "_deployed_by_alz_monitor": true + }, + "metadata": { + "displayName": "Resource Group Tags", + "description": "Tags to apply to the resource group" + } + }, + "ALZMonitorResourceGroupLocation": { + "type": "String", + "defaultValue": "centralus", + "metadata": { + "displayName": "Resource Group Location", + "description": "Location of the resource group" + } + }, + "ALZMonitorActionGroupEmail": { + "type": "Array", + "metadata": { + "displayName": "Action Group Email Addresses", + "description": "Email addresses to send alerts to" + }, + "defaultValue": [] + }, + "ALZMonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": "MonitorDisable" + }, + "ALZMonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] + }, + "ALZLogicappResourceId": { + "type": "String", + "metadata": { + "displayName": "Logic App Resource Id", + "description": "Logic App Resource Id for Action Group to send alerts to" + }, + "defaultValue": "" + }, + "ALZLogicappCallbackUrl": { + "type": "String", + "metadata": { + "displayName": "Logic App Callback URL", + "description": "Callback URL that triggers the Logic App" + }, + "defaultValue": "" + }, + "ALZArmRoleId": { + "type": "array", + "metadata": { + "displayName": "Arm Role Ids", + "description": "Arm Built-in Role Ids for action group to send alerts to" + }, + "defaultValue": [] + }, + "ALZEventHubResourceId": { + "type": "array", + "metadata": { + "displayName": "Event Hub resource Ids", + "description": "Event Hub resource Ids for action group to send alerts to" + }, + "defaultValue": [] + }, + "ALZWebhookServiceUri": { + "type": "Array", + "metadata": { + "displayName": "Webhook Service Uri(s)", + "description": "Indicates the service uri(s) of the webhook to send alerts to" + }, + "defaultValue": [] + }, + "ALZFunctionResourceId": { + "type": "String", + "metadata": { + "displayName": "Function Resource Id", + "description": "Function Resource Id for Action Group to send alerts to" + }, + "defaultValue": "" + }, + "ALZFunctionTriggerUrl": { + "type": "String", + "metadata": { + "displayName": "Function Trigger URL", + "description": "URL that triggers the Function" + }, + "defaultValue": "" + }, + "BYOActionGroup": { + "type": "array", + "metadata": { + "displayName": "Customer defined Action Group Resource IDs", + "description": "The Resource IDs of existing Action Groups currently deployed in the environment." + }, + "defaultValue": [] + }, + "BYOAlertProcessingRule": { + "type": "String", + "metadata": { + "displayName": "Customer defined Alert Processing Rule Resource ID", + "description": "The Resource ID of an existing Alert Processing Rule already deployed by the customer in his environment" + }, + "defaultValue": "" + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "ALZ_AlertProcessing_Rule", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_AlertProcessing_Rule", + "parameters": { + "ALZMonitorResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "ALZMonitorResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "ALZMonitorResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "ALZMonitorActionGroupEmail": { + "value": "[[[parameters('ALZMonitorActionGroupEmail')]" + }, + "ALZLogicappResourceId": { + "value": "[[[parameters('ALZLogicappResourceId')]" + }, + "ALZLogicappCallbackUrl": { + "value": "[[[parameters('ALZLogicappCallbackUrl')]" + }, + "ALZArmRoleId": { + "value": "[[[parameters('ALZArmRoleId')]" + }, + "ALZEventHubResourceId": { + "value": "[[[parameters('ALZEventHubResourceId')]" + }, + "ALZWebhookServiceUri": { + "value": "[[[parameters('ALZWebhookServiceUri')]" + }, + "ALZFunctionResourceId": { + "value": "[[[parameters('ALZFunctionResourceId')]" + }, + "ALZFunctionTriggerUrl": { + "value": "[[[parameters('ALZFunctionTriggerUrl')]" + }, + "BYOActionGroup": { + "value": "[[[parameters('BYOActionGroup')]" + }, + "BYOAlertProcessingRule": { + "value": "[[[parameters('BYOAlertProcessingRule')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_Suppression_AlertProcessing_Rule", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_Suppression_AlertProcessing_Rule", + "parameters": { + "ALZMonitorResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "ALZMonitorResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "ALZMonitorResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + } + ], + "policyType": "Custom", + "policyDefinitionGroups": null + } + }, + "cloudEnv": "[environment().name]", + "defaultDeploymentLocationByCloudType": { + "AzureCloud": "northeurope", + "AzureChinaCloud": "chinaeast2", + "AzureUSGovernment": "usgovvirginia" + }, + "templateVars": { + "scope": "/providers/Microsoft.Management/managementGroups/contoso", + "defaultDeploymentLocation": "\"location\": \"northeurope\"", + "localizedDeploymentLocation": "[format('\"location\": \"{0}\"', variables('defaultDeploymentLocationByCloudType')[variables('cloudEnv')])]" + }, + "targetDeploymentLocationByCloudType": { + "AzureCloud": "[coalesce(parameters('location'), 'northeurope')]", + "AzureChinaCloud": "[coalesce(parameters('location'), 'chinaeast2')]", + "AzureUSGovernment": "[coalesce(parameters('location'), 'usgovvirginia')]" + }, + "deploymentLocation": "[format('\"location\": \"{0}\"', variables('targetDeploymentLocationByCloudType')[variables('cloudEnv')])]", + "loadPolicyDefinitions": { + "All": [ + "[variables('$fxv#0')]", + "[variables('$fxv#1')]" + ], + "AzureCloud": [], + "AzureChinaCloud": [], + "AzureUSGovernment": [] + }, + "loadPolicySetDefinitions": { + "All": [ + "[string(variables('$fxv#2'))]" + ], + "AzureCloud": [], + "AzureChinaCloud": [], + "AzureUSGovernment": [] + }, + "policyDefinitionsByCloudType": { + "All": "[variables('policyDefinitionsAll')]", + "AzureCloud": "[variables('policyDefinitionsAzureCloud')]", + "AzureChinaCloud": "[variables('policyDefinitionsAzureChinaCloud')]", + "AzureUSGovernment": "[variables('policyDefinitionsAzureUSGovernment')]" + }, + "policySetDefinitionsByCloudType": { + "All": "[variables('policySetDefinitionsAll')]", + "AzureCloud": "[variables('policySetDefinitionsAzureCloud')]", + "AzureChinaCloud": "[variables('policySetDefinitionsAzureChinaCloud')]", + "AzureUSGovernment": "[variables('policySetDefinitionsAzureUSGovernment')]" + }, + "policyDefinitions": "[concat(variables('policyDefinitionsByCloudType').All, variables('policyDefinitionsByCloudType')[variables('cloudEnv')])]", + "policySetDefinitions": "[concat(variables('policySetDefinitionsByCloudType').All, variables('policySetDefinitionsByCloudType')[variables('cloudEnv')])]" + }, + "resources": [ + { + "copy": { + "name": "PolicyDefinitions", + "count": "[length(variables('policyDefinitions'))]" + }, + "type": "Microsoft.Authorization/policyDefinitions", + "apiVersion": "2020-09-01", + "name": "[variables('policyDefinitions')[copyIndex()].name]", + "properties": { + "description": "[variables('policyDefinitions')[copyIndex()].properties.description]", + "displayName": "[variables('policyDefinitions')[copyIndex()].properties.displayName]", + "metadata": "[variables('policyDefinitions')[copyIndex()].properties.metadata]", + "mode": "[variables('policyDefinitions')[copyIndex()].properties.mode]", + "parameters": "[variables('policyDefinitions')[copyIndex()].properties.parameters]", + "policyType": "[variables('policyDefinitions')[copyIndex()].properties.policyType]", + "policyRule": "[variables('policyDefinitions')[copyIndex()].properties.policyRule]" + } + }, + { + "copy": { + "name": "PolicySetDefinitions", + "count": "[length(variables('policySetDefinitions'))]" + }, + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2020-09-01", + "name": "[variables('policySetDefinitions')[copyIndex()].name]", + "properties": { + "description": "[variables('policySetDefinitions')[copyIndex()].properties.description]", + "displayName": "[variables('policySetDefinitions')[copyIndex()].properties.displayName]", + "metadata": "[variables('policySetDefinitions')[copyIndex()].properties.metadata]", + "parameters": "[variables('policySetDefinitions')[copyIndex()].properties.parameters]", + "policyType": "[variables('policySetDefinitions')[copyIndex()].properties.policyType]", + "policyDefinitions": "[variables('policySetDefinitions')[copyIndex()].properties.policyDefinitions]", + "policyDefinitionGroups": "[variables('policySetDefinitions')[copyIndex()].properties.policyDefinitionGroups]" + }, + "dependsOn": [ + "PolicyDefinitions" + ] + } + ], + "outputs": { + "policyDefinitionNames": { + "type": "array", + "copy": { + "count": "[length(variables('policyDefinitions'))]", + "input": "[variables('policyDefinitions')[copyIndex()].name]" + } + }, + "policySetDefinitionNames": { + "type": "array", + "copy": { + "count": "[length(variables('policySetDefinitions'))]", + "input": "[variables('policySetDefinitions')[copyIndex()].name]" + } + } + } +} \ No newline at end of file diff --git a/patterns/alz/policyDefinitions/policies-RecoveryServices.json b/patterns/alz/policyDefinitions/policies-RecoveryServices.json new file mode 100644 index 000000000..2efbf9e78 --- /dev/null +++ b/patterns/alz/policyDefinitions/policies-RecoveryServices.json @@ -0,0 +1,297 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-08-01/managementGroupDeploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.29.47.4906", + "templateHash": "14847613428435145634" + } + }, + "parameters": { + "topLevelManagementGroupPrefix": { + "type": "string", + "defaultValue": "alz", + "metadata": { + "message": "The JSON version of this file is programatically generated from Bicep. PLEASE DO NOT UPDATE MANUALLY!!", + "description": "Provide a prefix (unique at tenant-scope) for the Management Group hierarchy and other resources created as part of an Azure landing zone. DEFAULT VALUE = \"alz\"" + } + }, + "location": { + "type": "string", + "defaultValue": "[deployment().location]", + "metadata": { + "description": "Optionally set the deployment location for policies with Deploy If Not Exists effect. DEFAULT VALUE = \"deployment().location\"" + } + }, + "scope": { + "type": "string", + "defaultValue": "[tenantResourceId('Microsoft.Management/managementGroups', parameters('topLevelManagementGroupPrefix'))]", + "metadata": { + "description": "Optionally set the scope for custom Policy Definitions used in Policy Set Definitions (Initiatives). Must be one of '/', '/subscriptions/id' or '/providers/Microsoft.Management/managementGroups/id'. DEFAULT VALUE = '/providers/Microsoft.Management/managementGroups/${topLevelManagementGroupPrefix}'" + } + } + }, + "variables": { + "copy": [ + { + "name": "processPolicyDefinitionsAll", + "count": "[length(variables('loadPolicyDefinitions').All)]", + "input": "[replace(replace(variables('loadPolicyDefinitions').All[copyIndex('processPolicyDefinitionsAll')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" + }, + { + "name": "processPolicyDefinitionsAzureCloud", + "count": "[length(variables('loadPolicyDefinitions').AzureCloud)]", + "input": "[replace(replace(variables('loadPolicyDefinitions').AzureCloud[copyIndex('processPolicyDefinitionsAzureCloud')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" + }, + { + "name": "processPolicyDefinitionsAzureChinaCloud", + "count": "[length(variables('loadPolicyDefinitions').AzureChinaCloud)]", + "input": "[replace(replace(variables('loadPolicyDefinitions').AzureChinaCloud[copyIndex('processPolicyDefinitionsAzureChinaCloud')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" + }, + { + "name": "processPolicyDefinitionsAzureUSGovernment", + "count": "[length(variables('loadPolicyDefinitions').AzureUSGovernment)]", + "input": "[replace(replace(variables('loadPolicyDefinitions').AzureUSGovernment[copyIndex('processPolicyDefinitionsAzureUSGovernment')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" + }, + { + "name": "processPolicySetDefinitionsAll", + "count": "[length(variables('loadPolicySetDefinitions').All)]", + "input": "[replace(variables('loadPolicySetDefinitions').All[copyIndex('processPolicySetDefinitionsAll')], variables('templateVars').scope, parameters('scope'))]" + }, + { + "name": "processPolicySetDefinitionsAzureCloud", + "count": "[length(variables('loadPolicySetDefinitions').AzureCloud)]", + "input": "[replace(variables('loadPolicySetDefinitions').AzureCloud[copyIndex('processPolicySetDefinitionsAzureCloud')], variables('templateVars').scope, parameters('scope'))]" + }, + { + "name": "processPolicySetDefinitionsAzureChinaCloud", + "count": "[length(variables('loadPolicySetDefinitions').AzureChinaCloud)]", + "input": "[replace(variables('loadPolicySetDefinitions').AzureChinaCloud[copyIndex('processPolicySetDefinitionsAzureChinaCloud')], variables('templateVars').scope, parameters('scope'))]" + }, + { + "name": "processPolicySetDefinitionsAzureUSGovernment", + "count": "[length(variables('loadPolicySetDefinitions').AzureUSGovernment)]", + "input": "[replace(variables('loadPolicySetDefinitions').AzureUSGovernment[copyIndex('processPolicySetDefinitionsAzureUSGovernment')], variables('templateVars').scope, parameters('scope'))]" + }, + { + "name": "policyDefinitionsAll", + "count": "[length(variables('processPolicyDefinitionsAll'))]", + "input": "[json(variables('processPolicyDefinitionsAll')[copyIndex('policyDefinitionsAll')])]" + }, + { + "name": "policyDefinitionsAzureCloud", + "count": "[length(variables('processPolicyDefinitionsAzureCloud'))]", + "input": "[json(variables('processPolicyDefinitionsAzureCloud')[copyIndex('policyDefinitionsAzureCloud')])]" + }, + { + "name": "policyDefinitionsAzureChinaCloud", + "count": "[length(variables('processPolicyDefinitionsAzureChinaCloud'))]", + "input": "[json(variables('processPolicyDefinitionsAzureChinaCloud')[copyIndex('policyDefinitionsAzureChinaCloud')])]" + }, + { + "name": "policyDefinitionsAzureUSGovernment", + "count": "[length(variables('processPolicyDefinitionsAzureUSGovernment'))]", + "input": "[json(variables('processPolicyDefinitionsAzureUSGovernment')[copyIndex('policyDefinitionsAzureUSGovernment')])]" + }, + { + "name": "policySetDefinitionsAll", + "count": "[length(variables('processPolicySetDefinitionsAll'))]", + "input": "[json(variables('processPolicySetDefinitionsAll')[copyIndex('policySetDefinitionsAll')])]" + }, + { + "name": "policySetDefinitionsAzureCloud", + "count": "[length(variables('processPolicySetDefinitionsAzureCloud'))]", + "input": "[json(variables('processPolicySetDefinitionsAzureCloud')[copyIndex('policySetDefinitionsAzureCloud')])]" + }, + { + "name": "policySetDefinitionsAzureChinaCloud", + "count": "[length(variables('processPolicySetDefinitionsAzureChinaCloud'))]", + "input": "[json(variables('processPolicySetDefinitionsAzureChinaCloud')[copyIndex('policySetDefinitionsAzureChinaCloud')])]" + }, + { + "name": "policySetDefinitionsAzureUSGovernment", + "count": "[length(variables('processPolicySetDefinitionsAzureUSGovernment'))]", + "input": "[json(variables('processPolicySetDefinitionsAzureUSGovernment')[copyIndex('policySetDefinitionsAzureUSGovernment')])]" + } + ], + "$fxv#0": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_RecoveryVault_BackupHealthMonitor_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy RV Backup Health Monitoring Alerts\",\n \"description\": \"Policy to audit/update Recovery Vault Backup Health Alerting to Azure monitor alerts\",\n \"metadata\": {\n \"version\": \"1.1.0\",\n \"category\": \"Site Recovery\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"modify\",\n \"audit\",\n \"disabled\"\n ],\n \"defaultValue\": \"modify\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.RecoveryServices/Vaults\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n },\n {\n \"field\": \"Microsoft.RecoveryServices/vaults/monitoringSettings.azureMonitorAlertSettings.alertsForAllJobFailures\",\n \"notEquals\": \"Enabled\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"conflictEffect\": \"audit\",\n \"operations\": [\n {\n \"operation\": \"addOrReplace\",\n \"field\": \"Microsoft.RecoveryServices/vaults/monitoringSettings.classicAlertSettings.alertsForCriticalOperations\",\n \"value\": \"Disabled\"\n },\n {\n \"operation\": \"addOrReplace\",\n \"field\": \"Microsoft.RecoveryServices/vaults/monitoringSettings.azureMonitorAlertSettings.alertsForAllJobFailures\",\n \"value\": \"Enabled\"\n }\n ]\n }\n }\n }\n }\n}\n", + "$fxv#1": { + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "name": "Alerting-RecoveryServices", + "properties": { + "displayName": "Deploy Azure Monitor Baseline Alerts for Recovery Services", + "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Recovery Services such as Azure Backup, and Azure Site Recovery.", + "metadata": { + "version": "1.0.0", + "category": "Monitoring", + "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", + "alzCloudEnvironments": [ + "AzureCloud" + ], + "_deployed_by_amba": true + }, + "parameters": { + "ALZMonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": "MonitorDisable" + }, + "ALZMonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] + }, + "RVBackupHealthMonitorPolicyEffect": { + "type": "string", + "defaultValue": "modify", + "allowedValues": [ + "modify", + "audit", + "disabled" + ], + "metadata": { + "displayName": "Recovery Vault Backup Health Monitor Policy Effect", + "description": "Policy effect for the alert, modify will modify the alert if it exists, or audit if it does not exist" + } + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "ALZ_RVBackupHealthMonitor", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_RecoveryVault_BackupHealthMonitor_Alert", + "parameters": { + "effect": { + "value": "[[[parameters('RVBackupHealthMonitorPolicyEffect')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + } + ], + "policyType": "Custom", + "policyDefinitionGroups": null + } + }, + "cloudEnv": "[environment().name]", + "defaultDeploymentLocationByCloudType": { + "AzureCloud": "northeurope", + "AzureChinaCloud": "chinaeast2", + "AzureUSGovernment": "usgovvirginia" + }, + "templateVars": { + "scope": "/providers/Microsoft.Management/managementGroups/contoso", + "defaultDeploymentLocation": "\"location\": \"northeurope\"", + "localizedDeploymentLocation": "[format('\"location\": \"{0}\"', variables('defaultDeploymentLocationByCloudType')[variables('cloudEnv')])]" + }, + "targetDeploymentLocationByCloudType": { + "AzureCloud": "[coalesce(parameters('location'), 'northeurope')]", + "AzureChinaCloud": "[coalesce(parameters('location'), 'chinaeast2')]", + "AzureUSGovernment": "[coalesce(parameters('location'), 'usgovvirginia')]" + }, + "deploymentLocation": "[format('\"location\": \"{0}\"', variables('targetDeploymentLocationByCloudType')[variables('cloudEnv')])]", + "loadPolicyDefinitions": { + "All": [ + "[variables('$fxv#0')]" + ], + "AzureCloud": [], + "AzureChinaCloud": [], + "AzureUSGovernment": [] + }, + "loadPolicySetDefinitions": { + "All": [ + "[string(variables('$fxv#1'))]" + ], + "AzureCloud": [], + "AzureChinaCloud": [], + "AzureUSGovernment": [] + }, + "policyDefinitionsByCloudType": { + "All": "[variables('policyDefinitionsAll')]", + "AzureCloud": "[variables('policyDefinitionsAzureCloud')]", + "AzureChinaCloud": "[variables('policyDefinitionsAzureChinaCloud')]", + "AzureUSGovernment": "[variables('policyDefinitionsAzureUSGovernment')]" + }, + "policySetDefinitionsByCloudType": { + "All": "[variables('policySetDefinitionsAll')]", + "AzureCloud": "[variables('policySetDefinitionsAzureCloud')]", + "AzureChinaCloud": "[variables('policySetDefinitionsAzureChinaCloud')]", + "AzureUSGovernment": "[variables('policySetDefinitionsAzureUSGovernment')]" + }, + "policyDefinitions": "[concat(variables('policyDefinitionsByCloudType').All, variables('policyDefinitionsByCloudType')[variables('cloudEnv')])]", + "policySetDefinitions": "[concat(variables('policySetDefinitionsByCloudType').All, variables('policySetDefinitionsByCloudType')[variables('cloudEnv')])]" + }, + "resources": [ + { + "copy": { + "name": "PolicyDefinitions", + "count": "[length(variables('policyDefinitions'))]" + }, + "type": "Microsoft.Authorization/policyDefinitions", + "apiVersion": "2020-09-01", + "name": "[variables('policyDefinitions')[copyIndex()].name]", + "properties": { + "description": "[variables('policyDefinitions')[copyIndex()].properties.description]", + "displayName": "[variables('policyDefinitions')[copyIndex()].properties.displayName]", + "metadata": "[variables('policyDefinitions')[copyIndex()].properties.metadata]", + "mode": "[variables('policyDefinitions')[copyIndex()].properties.mode]", + "parameters": "[variables('policyDefinitions')[copyIndex()].properties.parameters]", + "policyType": "[variables('policyDefinitions')[copyIndex()].properties.policyType]", + "policyRule": "[variables('policyDefinitions')[copyIndex()].properties.policyRule]" + } + }, + { + "copy": { + "name": "PolicySetDefinitions", + "count": "[length(variables('policySetDefinitions'))]" + }, + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2020-09-01", + "name": "[variables('policySetDefinitions')[copyIndex()].name]", + "properties": { + "description": "[variables('policySetDefinitions')[copyIndex()].properties.description]", + "displayName": "[variables('policySetDefinitions')[copyIndex()].properties.displayName]", + "metadata": "[variables('policySetDefinitions')[copyIndex()].properties.metadata]", + "parameters": "[variables('policySetDefinitions')[copyIndex()].properties.parameters]", + "policyType": "[variables('policySetDefinitions')[copyIndex()].properties.policyType]", + "policyDefinitions": "[variables('policySetDefinitions')[copyIndex()].properties.policyDefinitions]", + "policyDefinitionGroups": "[variables('policySetDefinitions')[copyIndex()].properties.policyDefinitionGroups]" + }, + "dependsOn": [ + "PolicyDefinitions" + ] + } + ], + "outputs": { + "policyDefinitionNames": { + "type": "array", + "copy": { + "count": "[length(variables('policyDefinitions'))]", + "input": "[variables('policyDefinitions')[copyIndex()].name]" + } + }, + "policySetDefinitionNames": { + "type": "array", + "copy": { + "count": "[length(variables('policySetDefinitions'))]", + "input": "[variables('policySetDefinitions')[copyIndex()].name]" + } + } + } +} \ No newline at end of file diff --git a/patterns/alz/policyDefinitions/policies-ServiceHealth.json b/patterns/alz/policyDefinitions/policies-ServiceHealth.json new file mode 100644 index 000000000..329bcbcb9 --- /dev/null +++ b/patterns/alz/policyDefinitions/policies-ServiceHealth.json @@ -0,0 +1,698 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-08-01/managementGroupDeploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.29.47.4906", + "templateHash": "10650350275515818338" + } + }, + "parameters": { + "topLevelManagementGroupPrefix": { + "type": "string", + "defaultValue": "alz", + "metadata": { + "message": "The JSON version of this file is programatically generated from Bicep. PLEASE DO NOT UPDATE MANUALLY!!", + "description": "Provide a prefix (unique at tenant-scope) for the Management Group hierarchy and other resources created as part of an Azure landing zone. DEFAULT VALUE = \"alz\"" + } + }, + "location": { + "type": "string", + "defaultValue": "[deployment().location]", + "metadata": { + "description": "Optionally set the deployment location for policies with Deploy If Not Exists effect. DEFAULT VALUE = \"deployment().location\"" + } + }, + "scope": { + "type": "string", + "defaultValue": "[tenantResourceId('Microsoft.Management/managementGroups', parameters('topLevelManagementGroupPrefix'))]", + "metadata": { + "description": "Optionally set the scope for custom Policy Definitions used in Policy Set Definitions (Initiatives). Must be one of '/', '/subscriptions/id' or '/providers/Microsoft.Management/managementGroups/id'. DEFAULT VALUE = '/providers/Microsoft.Management/managementGroups/${topLevelManagementGroupPrefix}'" + } + } + }, + "variables": { + "copy": [ + { + "name": "processPolicyDefinitionsAll", + "count": "[length(variables('loadPolicyDefinitions').All)]", + "input": "[replace(replace(variables('loadPolicyDefinitions').All[copyIndex('processPolicyDefinitionsAll')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" + }, + { + "name": "processPolicyDefinitionsAzureCloud", + "count": "[length(variables('loadPolicyDefinitions').AzureCloud)]", + "input": "[replace(replace(variables('loadPolicyDefinitions').AzureCloud[copyIndex('processPolicyDefinitionsAzureCloud')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" + }, + { + "name": "processPolicyDefinitionsAzureChinaCloud", + "count": "[length(variables('loadPolicyDefinitions').AzureChinaCloud)]", + "input": "[replace(replace(variables('loadPolicyDefinitions').AzureChinaCloud[copyIndex('processPolicyDefinitionsAzureChinaCloud')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" + }, + { + "name": "processPolicyDefinitionsAzureUSGovernment", + "count": "[length(variables('loadPolicyDefinitions').AzureUSGovernment)]", + "input": "[replace(replace(variables('loadPolicyDefinitions').AzureUSGovernment[copyIndex('processPolicyDefinitionsAzureUSGovernment')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" + }, + { + "name": "processPolicySetDefinitionsAll", + "count": "[length(variables('loadPolicySetDefinitions').All)]", + "input": "[replace(variables('loadPolicySetDefinitions').All[copyIndex('processPolicySetDefinitionsAll')], variables('templateVars').scope, parameters('scope'))]" + }, + { + "name": "processPolicySetDefinitionsAzureCloud", + "count": "[length(variables('loadPolicySetDefinitions').AzureCloud)]", + "input": "[replace(variables('loadPolicySetDefinitions').AzureCloud[copyIndex('processPolicySetDefinitionsAzureCloud')], variables('templateVars').scope, parameters('scope'))]" + }, + { + "name": "processPolicySetDefinitionsAzureChinaCloud", + "count": "[length(variables('loadPolicySetDefinitions').AzureChinaCloud)]", + "input": "[replace(variables('loadPolicySetDefinitions').AzureChinaCloud[copyIndex('processPolicySetDefinitionsAzureChinaCloud')], variables('templateVars').scope, parameters('scope'))]" + }, + { + "name": "processPolicySetDefinitionsAzureUSGovernment", + "count": "[length(variables('loadPolicySetDefinitions').AzureUSGovernment)]", + "input": "[replace(variables('loadPolicySetDefinitions').AzureUSGovernment[copyIndex('processPolicySetDefinitionsAzureUSGovernment')], variables('templateVars').scope, parameters('scope'))]" + }, + { + "name": "policyDefinitionsAll", + "count": "[length(variables('processPolicyDefinitionsAll'))]", + "input": "[json(variables('processPolicyDefinitionsAll')[copyIndex('policyDefinitionsAll')])]" + }, + { + "name": "policyDefinitionsAzureCloud", + "count": "[length(variables('processPolicyDefinitionsAzureCloud'))]", + "input": "[json(variables('processPolicyDefinitionsAzureCloud')[copyIndex('policyDefinitionsAzureCloud')])]" + }, + { + "name": "policyDefinitionsAzureChinaCloud", + "count": "[length(variables('processPolicyDefinitionsAzureChinaCloud'))]", + "input": "[json(variables('processPolicyDefinitionsAzureChinaCloud')[copyIndex('policyDefinitionsAzureChinaCloud')])]" + }, + { + "name": "policyDefinitionsAzureUSGovernment", + "count": "[length(variables('processPolicyDefinitionsAzureUSGovernment'))]", + "input": "[json(variables('processPolicyDefinitionsAzureUSGovernment')[copyIndex('policyDefinitionsAzureUSGovernment')])]" + }, + { + "name": "policySetDefinitionsAll", + "count": "[length(variables('processPolicySetDefinitionsAll'))]", + "input": "[json(variables('processPolicySetDefinitionsAll')[copyIndex('policySetDefinitionsAll')])]" + }, + { + "name": "policySetDefinitionsAzureCloud", + "count": "[length(variables('processPolicySetDefinitionsAzureCloud'))]", + "input": "[json(variables('processPolicySetDefinitionsAzureCloud')[copyIndex('policySetDefinitionsAzureCloud')])]" + }, + { + "name": "policySetDefinitionsAzureChinaCloud", + "count": "[length(variables('processPolicySetDefinitionsAzureChinaCloud'))]", + "input": "[json(variables('processPolicySetDefinitionsAzureChinaCloud')[copyIndex('policySetDefinitionsAzureChinaCloud')])]" + }, + { + "name": "policySetDefinitionsAzureUSGovernment", + "count": "[length(variables('processPolicySetDefinitionsAzureUSGovernment'))]", + "input": "[json(variables('processPolicySetDefinitionsAzureUSGovernment')[copyIndex('policySetDefinitionsAzureUSGovernment')])]" + } + ], + "$fxv#0": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_ServiceHealth_ActionGroups\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Service Health Action Group\",\n \"description\": \"Policy to deploy action group for Service Health alerts\",\n \"metadata\": {\n \"version\": \"1.3.0\",\n \"category\": \"Monitoring\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n },\n \"ALZMonitorResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"ALZMonitorResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"_deployed_by_amba\": true\n }\n },\n \"ALZMonitorResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"ALZMonitorActionGroupEmail\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"Action Group Email Addresses\",\n \"description\": \"Email addresses to send alerts to\"\n },\n \"defaultValue\": []\n },\n \"ALZLogicappResourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Logic App Resource Id\",\n \"description\": \"Logic App Resource Id for Action Group to send alerts to\"\n },\n \"defaultValue\": \"\"\n },\n \"ALZLogicappCallbackUrl\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Logic App Callback URL\",\n \"description\": \"Callback URL that triggers the Logic App\"\n },\n \"defaultValue\": \"\"\n },\n \"ALZArmRoleId\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Arm Role Ids\",\n \"description\": \"Arm Built-in Role Ids for action group to send alerts to\"\n },\n \"defaultValue\": []\n },\n \"ALZEventHubResourceId\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Event Hub resource Ids\",\n \"description\": \"Event Hub resource Ids for action group to send alerts to\"\n },\n \"defaultValue\": []\n },\n \"ALZWebhookServiceUri\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"Webhook Service Uri(s)\",\n \"description\": \"Indicates the service uri(s) of the webhook to send alerts to\"\n },\n \"defaultValue\": []\n },\n \"ALZFunctionResourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Function Resource Id\",\n \"description\": \"Function Resource Id for Action Group to send alerts to\"\n },\n \"defaultValue\": \"\"\n },\n \"ALZFunctionTriggerUrl\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Function Trigger URL\",\n \"description\": \"URL that triggers the Function\"\n },\n \"defaultValue\": \"\"\n },\n \"BYOActionGroup\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Customer defined Action Group Resource IDs\",\n \"description\": \"The Resource IDs of existing Action Groups currently deployed in the environment.\"\n },\n \"defaultValue\": []\n },\n \"BYOAlertProcessingRule\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Customer defined Alert Processing Rule Resource ID\",\n \"description\": \"The Resource ID of an existing Alert Processing Rule already deployed by the customer in his environment\"\n },\n \"defaultValue\": \"\"\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Resources/subscriptions\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n },\n {\n \"value\": \"[[empty(parameters('BYOActionGroup'))]\",\n \"equals\": \"true\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"deployIfNotExists\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/actionGroups\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('ALZMonitorResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"value\": \"[[empty(parameters('BYOActionGroup'))]\",\n \"equals\": true\n },\n {\n \"field\": \"Microsoft.Insights/actionGroups/groupShortName\",\n \"equals\": \"SH-ActGrp\"\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"ALZMonitorResourceGroupName\": {\n \"type\": \"string\"\n },\n \"ALZMonitorResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"ALZMonitorResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"ALZMonitorActionGroupEmail\": {\n \"type\": \"Array\"\n },\n \"ALZLogicappResourceId\": {\n \"type\": \"string\"\n },\n \"ALZLogicappCallbackUrl\": {\n \"type\": \"String\"\n },\n \"ALZArmRoleId\": {\n \"type\": \"array\"\n },\n \"ALZEventHubResourceId\": {\n \"type\": \"array\"\n },\n \"ALZWebhookServiceUri\": {\n \"type\": \"Array\"\n },\n \"ALZFunctionResourceId\": {\n \"type\": \"string\"\n },\n \"ALZFunctionTriggerUrl\": {\n \"type\": \"String\"\n },\n \"BYOActionGroup\": {\n \"type\": \"array\"\n },\n \"BYOAlertProcessingRule\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {\n \"varLogicAppReceivers\": [\n {\n \"name\": \"AlzLA-0\",\n \"resourceId\": \"[[if(empty(parameters('ALZLogicappResourceId')), null(), trim(parameters('ALZLogicappResourceId')))]\",\n \"callbackUrl\": \"[[if(empty(parameters('ALZLogicappCallbackUrl')), null(), trim(parameters('ALZLogicappCallbackUrl')))]\",\n \"useCommonSchema\": true\n }\n ],\n \"varAzureFunctionReceivers\": [\n {\n \"name\": \"AlzFa-0\",\n \"functionAppResourceId\": \"[[if(empty(parameters('ALZFunctionResourceId')), null(), split(trim(parameters('ALZFunctionResourceId')),'/functions/')[0])]\",\n \"functionName\": \"[[if(empty(parameters('ALZFunctionResourceId')), null(), split(trim(parameters('ALZFunctionResourceId')),'/')[10])]\",\n \"httpTriggerUrl\": \"[[if(empty(parameters('ALZFunctionTriggerUrl')), null(), trim(parameters('ALZFunctionTriggerUrl')))]\",\n \"useCommonAlertSchema\": true\n }\n ],\n \"copy\": [\n {\n \"name\": \"varEmailReceivers\",\n \"count\": \"[[length(parameters('ALZMonitorActionGroupEmail'))]\",\n \"mode\": \"serial\",\n \"input\": {\n \"name\": \"[[concat('AlzMail-', indexOf(parameters('ALZMonitorActionGroupEmail'), parameters('ALZMonitorActionGroupEmail')[copyIndex('varEmailReceivers')]))]\",\n \"emailAddress\": \"[[trim(parameters('ALZMonitorActionGroupEmail')[copyIndex('varEmailReceivers')])]\",\n \"useCommonSchema\": true\n }\n },\n {\n \"name\": \"varArmRoleReceivers\",\n \"count\": \"[[length(parameters('ALZArmRoleId'))]\",\n \"mode\": \"serial\",\n \"input\": {\n \"name\": \"[[concat('AlzARM-', indexOf(parameters('ALZArmRoleId'), parameters('ALZArmRoleId')[copyIndex('varArmRoleReceivers')]))]\",\n \"roleId\": \"[[trim(parameters('ALZArmRoleId')[copyIndex('varArmRoleReceivers')])]\",\n \"useCommonSchema\": true\n }\n },\n {\n \"name\": \"varEventHubReceivers\",\n \"count\": \"[[length(parameters('ALZEventHubResourceId'))]\",\n \"mode\": \"serial\",\n \"input\": {\n \"name\": \"[[concat('AlzEH-', indexOf(parameters('ALZEventHubResourceId'), parameters('ALZEventHubResourceId')[copyIndex('varEventHubReceivers')]))]\",\n \"subscriptionId\": \"[[if(empty(parameters('ALZEventHubResourceId')), null(), split(trim(parameters('ALZEventHubResourceId')[copyIndex('varEventHubReceivers')]),'/')[2])]\",\n \"eventHubNameSpace\": \"[[if(empty(parameters('ALZEventHubResourceId')), null(), split(trim(parameters('ALZEventHubResourceId')[copyIndex('varEventHubReceivers')]),'/')[8])]\",\n \"eventHubName\": \"[[if(empty(parameters('ALZEventHubResourceId')), null(), split(trim(parameters('ALZEventHubResourceId')[copyIndex('varEventHubReceivers')]),'/')[10])]\",\n \"useCommonAlertSchema\": true,\n \"tenantId\": \"[[subscription().tenantId]\"\n }\n },\n {\n \"name\": \"varWebhookReceivers\",\n \"count\": \"[[length(parameters('ALZWebhookServiceUri'))]\",\n \"mode\": \"serial\",\n \"input\": {\n \"name\": \"[[concat('AlzWh-', indexOf(parameters('ALZWebhookServiceUri'), parameters('ALZWebhookServiceUri')[copyIndex('varWebhookReceivers')]))]\",\n \"identifierUri\": \"null()\",\n \"objectId\": \"null()\",\n \"serviceUri\": \"[[trim(parameters('ALZWebhookServiceUri')[copyIndex('varWebhookReceivers')])]\",\n \"useCommonAlertSchema\": true,\n \"tenantId\": \"null()\",\n \"useAadAuth\": \"false\"\n }\n }\n ]\n },\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('ALZMonitorResourceGroupName')]\",\n \"location\": \"[[parameters('ALZMonitorResourceGroupLocation')]\",\n \"tags\": \"[[parameters('ALZMonitorResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"SH-ActionGroupDeployment\",\n \"resourceGroup\": \"[[parameters('ALZMonitorResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('ALZMonitorResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"ALZMonitorResourceGroupName\": {\n \"type\": \"string\"\n },\n \"ALZMonitorActionGroupEmail\": {\n \"type\": \"Array\"\n },\n \"ALZLogicappResourceId\": {\n \"type\": \"string\"\n },\n \"ALZLogicappCallbackUrl\": {\n \"type\": \"string\"\n },\n \"ALZArmRoleId\": {\n \"type\": \"array\"\n },\n \"ALZEventHubResourceId\": {\n \"type\": \"array\"\n },\n \"ALZWebhookServiceUri\": {\n \"type\": \"Array\"\n },\n \"ALZFunctionResourceId\": {\n \"type\": \"string\"\n },\n \"ALZFunctionTriggerUrl\": {\n \"type\": \"string\"\n },\n \"BYOActionGroup\": {\n \"type\": \"array\"\n },\n \"BYOAlertProcessingRule\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"condition\": \"[[empty(parameters('BYOActionGroup'))]\",\n \"type\": \"Microsoft.Insights/actionGroups\",\n \"apiVersion\": \"2023-01-01\",\n \"name\": \"[[concat('ag-AMBA-SH-', subscription().displayName, '-001')]\",\n \"location\": \"Global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"groupShortName\": \"SH-ActGrp\",\n \"enabled\": true,\n \"emailReceivers\": \"[[if(empty(parameters('ALZMonitorActionGroupEmail')), null(), variables('varEmailReceivers'))]\",\n \"armRoleReceivers\": \"[[if(empty(parameters('ALZArmRoleId')), null(), variables('varArmRoleReceivers'))]\",\n \"logicAppReceivers\": \"[[if(empty(parameters('ALZLogicappResourceId')), null(), variables('varLogicAppReceivers'))]\",\n \"eventHubReceivers\": \"[[if(empty(parameters('ALZEventHubResourceId')), null(), variables('varEventHubReceivers'))]\",\n \"webhookReceivers\": \"[[if(empty(parameters('ALZWebhookServiceUri')), null(), variables('varWebhookReceivers'))]\",\n \"azureFunctionReceivers\": \"[[if(empty(parameters('ALZFunctionResourceId')), null(), variables('varAzureFunctionReceivers'))]\"\n }\n }\n ]\n },\n \"parameters\": {\n \"ALZMonitorResourceGroupName\": {\n \"value\": \"[[parameters('ALZMonitorResourceGroupName')]\"\n },\n \"ALZMonitorActionGroupEmail\": {\n \"value\": \"[[parameters('ALZMonitorActionGroupEmail')]\"\n },\n \"ALZLogicappResourceId\": {\n \"value\": \"[[parameters('ALZLogicappResourceId')]\"\n },\n \"ALZLogicappCallbackUrl\": {\n \"value\": \"[[parameters('ALZLogicappCallbackUrl')]\"\n },\n \"ALZArmRoleId\": {\n \"value\": \"[[parameters('ALZArmRoleId')]\"\n },\n \"ALZEventHubResourceId\": {\n \"value\": \"[[parameters('ALZEventHubResourceId')]\"\n },\n \"ALZWebhookServiceUri\": {\n \"value\": \"[[parameters('ALZWebhookServiceUri')]\"\n },\n \"ALZFunctionResourceId\": {\n \"value\": \"[[parameters('ALZFunctionResourceId')]\"\n },\n \"ALZFunctionTriggerUrl\": {\n \"value\": \"[[parameters('ALZFunctionTriggerUrl')]\"\n },\n \"BYOActionGroup\": {\n \"value\": \"[[parameters('BYOActionGroup')]\"\n },\n \"BYOAlertProcessingRule\": {\n \"value\": \"[[parameters('BYOAlertProcessingRule')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"ALZMonitorResourceGroupName\": {\n \"value\": \"[[parameters('ALZMonitorResourceGroupName')]\"\n },\n \"ALZMonitorResourceGroupTags\": {\n \"value\": \"[[parameters('ALZMonitorResourceGroupTags')]\"\n },\n \"ALZMonitorResourceGroupLocation\": {\n \"value\": \"[[parameters('ALZMonitorResourceGroupLocation')]\"\n },\n \"ALZMonitorActionGroupEmail\": {\n \"value\": \"[[parameters('ALZMonitorActionGroupEmail')]\"\n },\n \"ALZLogicappResourceId\": {\n \"value\": \"[[parameters('ALZLogicappResourceId')]\"\n },\n \"ALZLogicappCallbackUrl\": {\n \"value\": \"[[parameters('ALZLogicappCallbackUrl')]\"\n },\n \"ALZArmRoleId\": {\n \"value\": \"[[parameters('ALZArmRoleId')]\"\n },\n \"ALZEventHubResourceId\": {\n \"value\": \"[[parameters('ALZEventHubResourceId')]\"\n },\n \"ALZWebhookServiceUri\": {\n \"value\": \"[[parameters('ALZWebhookServiceUri')]\"\n },\n \"ALZFunctionResourceId\": {\n \"value\": \"[[parameters('ALZFunctionResourceId')]\"\n },\n \"ALZFunctionTriggerUrl\": {\n \"value\": \"[[parameters('ALZFunctionTriggerUrl')]\"\n },\n \"BYOActionGroup\": {\n \"value\": \"[[parameters('BYOActionGroup')]\"\n },\n \"BYOAlertProcessingRule\": {\n \"value\": \"[[parameters('BYOAlertProcessingRule')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#1": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_activitylog_ResourceHealth_Unhealthy_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Resource Health Unhealthy Alert\",\n \"description\": \"Policy to Deploy Resource Health Unhealthy Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Monitoring\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"_deployed_by_amba\": true\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"disabled\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n },\n \"BYOActionGroup\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Customer defined Action Group Resource IDs\",\n \"description\": \"The Resource IDs of existing Action Groups currently deployed in the environment.\"\n },\n \"defaultValue\": []\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Resources/subscriptions\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/activityLogAlerts\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"anyOf\": [\n {\n \"allOf\": [\n {\n \"value\": \"[[empty(parameters('BYOActionGroup'))]\",\n \"equals\": true\n },\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/actions.actionGroups[*].actionGroupId\",\n \"contains\": \"ag-AMBA-SH-\"\n }\n ]\n },\n {\n \"allOf\": [\n {\n \"value\": \"[[empty(parameters('BYOActionGroup'))]\",\n \"equals\": false\n },\n {\n \"count\": {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/actions.actionGroups[*]\",\n \"where\": {\n \"anyOf\": [\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/actions.actionGroups[*].actionGroupId\",\n \"in\": \"[[parameters('BYOActionGroup')]\"\n }\n ]\n }\n },\n \"greaterOrEquals\": 1\n }\n ]\n }\n ]\n },\n {\n \"count\": {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*]\",\n \"where\": {\n \"anyOf\": [\n {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].field\",\n \"equals\": \"category\"\n },\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].equals\",\n \"equals\": \"ResourceHealth\"\n }\n ]\n }\n ]\n }\n },\n \"equals\": 1\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"enabled\": {\n \"type\": \"string\"\n },\n \"BYOActionGroup\": {\n \"type\": \"array\"\n }\n },\n \"variables\": {\n \"copy\": [\n {\n \"name\": \"varActionGroupIds\",\n \"count\": \"[[length(parameters('BYOActionGroup'))]\",\n \"mode\": \"serial\",\n \"input\": {\n \"actionGroupId\": \"[[trim(parameters('BYOActionGroup')[copyIndex('varActionGroupIds')])]\"\n }\n }\n ]\n },\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"ResourceHealtAlert\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[resourceId('Microsoft.Resources/resourceGroups', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"BYOActionGroup\": {\n \"type\": \"array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"condition\": \"[[empty(parameters('BYOActionGroup'))]\",\n \"type\": \"microsoft.insights/activityLogAlerts\",\n \"apiVersion\": \"2020-10-01\",\n \"name\": \"ResourceHealthUnhealthyAlert\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"actions\": {\n \"actionGroups\": [\n {\n \"actionGroupId\": \"[[concat(subscription().Id, '/resourceGroups/', parameters('alertResourceGroupName'), '/providers/microsoft.insights/actionGroups/', 'ag-AMBA-SH-', subscription().displayName, '-001')]\",\n \"webhookProperties\": {}\n }\n ]\n },\n \"description\": \"Resource Health Unhealthy Alert\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().id]\"\n ],\n \"condition\": {\n \"allOf\": [\n {\n \"field\": \"category\",\n \"equals\": \"ResourceHealth\"\n },\n {\n \"anyOf\": [\n {\n \"field\": \"properties.cause\",\n \"equals\": \"PlatformInitiated\"\n },\n {\n \"field\": \"properties.cause\",\n \"equals\": \"UserInitiated\"\n }\n ]\n },\n {\n \"anyOf\": [\n {\n \"field\": \"properties.currentHealthStatus\",\n \"equals\": \"Degraded\"\n },\n {\n \"field\": \"properties.currentHealthStatus\",\n \"equals\": \"Unavailable\"\n }\n ]\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n },\n {\n \"condition\": \"[[not(empty(parameters('BYOActionGroup')))]\",\n \"type\": \"microsoft.insights/activityLogAlerts\",\n \"apiVersion\": \"2020-10-01\",\n \"name\": \"ResourceHealthUnhealthyAlert\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"actions\": {\n \"actionGroups\": \"[[variables('varActionGroupIds')]\"\n },\n \"description\": \"Resource Health Unhealthy Alert\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().id]\"\n ],\n \"condition\": {\n \"allOf\": [\n {\n \"field\": \"category\",\n \"equals\": \"ResourceHealth\"\n },\n {\n \"anyOf\": [\n {\n \"field\": \"properties.cause\",\n \"equals\": \"PlatformInitiated\"\n },\n {\n \"field\": \"properties.cause\",\n \"equals\": \"UserInitiated\"\n }\n ]\n },\n {\n \"anyOf\": [\n {\n \"field\": \"properties.currentHealthStatus\",\n \"equals\": \"Degraded\"\n },\n {\n \"field\": \"properties.currentHealthStatus\",\n \"equals\": \"Unavailable\"\n }\n ]\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"BYOActionGroup\": {\n \"value\": \"[[parameters('BYOActionGroup')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"BYOActionGroup\": {\n \"value\": \"[[parameters('BYOActionGroup')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#2": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_activitylog_ServiceHealth_HealthAdvisory\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Service Health Advisory Alert\",\n \"description\": \"Policy to Deploy Service Health Advisory Alert\",\n \"metadata\": {\n \"version\": \"1.3.0\",\n \"category\": \"Monitoring\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"_deployed_by_amba\": true\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"disabled\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n },\n \"ALZMonitorActionGroupEmail\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"Action Group Email Addresses\",\n \"description\": \"Email addresses to send alerts to\"\n },\n \"defaultValue\": []\n },\n \"BYOActionGroup\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Customer defined Action Group Resource IDs\",\n \"description\": \"The Resource IDs of existing Action Groups currently deployed in the environment.\"\n },\n \"defaultValue\": []\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Resources/subscriptions\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/activityLogAlerts\",\n \"existenceScope\": \"resourceGroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"anyOf\": [\n {\n \"allOf\": [\n {\n \"value\": \"[[empty(parameters('BYOActionGroup'))]\",\n \"equals\": true\n },\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/actions.actionGroups[*].actionGroupId\",\n \"contains\": \"ag-AMBA-SH-\"\n }\n ]\n },\n {\n \"allOf\": [\n {\n \"value\": \"[[empty(parameters('BYOActionGroup'))]\",\n \"equals\": false\n },\n {\n \"count\": {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/actions.actionGroups[*]\",\n \"where\": {\n \"anyOf\": [\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/actions.actionGroups[*].actionGroupId\",\n \"in\": \"[[parameters('BYOActionGroup')]\"\n }\n ]\n }\n },\n \"greaterOrEquals\": 1\n }\n ]\n }\n ]\n },\n {\n \"count\": {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*]\",\n \"where\": {\n \"anyOf\": [\n {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].field\",\n \"equals\": \"category\"\n },\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].equals\",\n \"equals\": \"ServiceHealth\"\n }\n ]\n },\n {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].field\",\n \"equals\": \"properties.incidentType\"\n },\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].equals\",\n \"equals\": \"ActionRequired\"\n }\n ]\n }\n ]\n }\n },\n \"equals\": 2\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"enabled\": {\n \"type\": \"string\"\n },\n \"ALZMonitorActionGroupEmail\": {\n \"type\": \"Array\"\n },\n \"BYOActionGroup\": {\n \"type\": \"array\"\n }\n },\n \"variables\": {\n \"copy\": [\n {\n \"name\": \"varActionGroupIds\",\n \"count\": \"[[length(parameters('BYOActionGroup'))]\",\n \"mode\": \"serial\",\n \"input\": {\n \"actionGroupId\": \"[[trim(parameters('BYOActionGroup')[copyIndex('varActionGroupIds')])]\"\n }\n }\n ]\n },\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"ServiceHealthHealth\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[resourceId('Microsoft.Resources/resourceGroups', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"ALZMonitorActionGroupEmail\": {\n \"type\": \"Array\"\n },\n \"BYOActionGroup\": {\n \"type\": \"array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"condition\": \"[[empty(parameters('BYOActionGroup'))]\",\n \"type\": \"microsoft.insights/activityLogAlerts\",\n \"apiVersion\": \"2020-10-01\",\n \"name\": \"ServiceHealthAdvisoryEvent\",\n \"location\": \"Global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"actions\": {\n \"actionGroups\": [\n {\n \"actionGroupId\": \"[[concat(subscription().Id, '/resourceGroups/', parameters('alertResourceGroupName'), '/providers/microsoft.insights/actionGroups/', 'ag-AMBA-SH-', subscription().displayName, '-001')]\"\n }\n ]\n },\n \"description\": \"Service Health Advisory Alert\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().id]\"\n ],\n \"condition\": {\n \"allOf\": [\n {\n \"field\": \"category\",\n \"equals\": \"ServiceHealth\"\n },\n {\n \"field\": \"properties.incidentType\",\n \"equals\": \"ActionRequired\"\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n },\n {\n \"condition\": \"[[not(empty(parameters('BYOActionGroup')))]\",\n \"type\": \"microsoft.insights/activityLogAlerts\",\n \"apiVersion\": \"2020-10-01\",\n \"name\": \"ServiceHealthAdvisoryEvent\",\n \"location\": \"Global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"actions\": {\n \"actionGroups\": \"[[variables('varActionGroupIds')]\"\n },\n \"description\": \"Service Health Advisory Alert\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().id]\"\n ],\n \"condition\": {\n \"allOf\": [\n {\n \"field\": \"category\",\n \"equals\": \"ServiceHealth\"\n },\n {\n \"field\": \"properties.incidentType\",\n \"equals\": \"ActionRequired\"\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"ALZMonitorActionGroupEmail\": {\n \"value\": \"[[parameters('ALZMonitorActionGroupEmail')]\"\n },\n \"BYOActionGroup\": {\n \"value\": \"[[parameters('BYOActionGroup')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"ALZMonitorActionGroupEmail\": {\n \"value\": \"[[parameters('ALZMonitorActionGroupEmail')]\"\n },\n \"BYOActionGroup\": {\n \"value\": \"[[parameters('BYOActionGroup')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#3": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_activitylog_ServiceHealth_Incident\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Service Health Incident Alert\",\n \"description\": \"Policy to Deploy Service Health Incident Alert\",\n \"metadata\": {\n \"version\": \"1.3.0\",\n \"category\": \"Monitoring\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"_deployed_by_amba\": true\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"disabled\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n },\n \"ALZMonitorActionGroupEmail\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"Action Group Email Addresses\",\n \"description\": \"Email addresses to send alerts to\"\n },\n \"defaultValue\": []\n },\n \"BYOActionGroup\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Customer defined Action Group Resource IDs\",\n \"description\": \"The Resource IDs of existing Action Groups currently deployed in the environment.\"\n },\n \"defaultValue\": []\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Resources/subscriptions\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/activityLogAlerts\",\n \"existenceScope\": \"resourcegroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"anyOf\": [\n {\n \"allOf\": [\n {\n \"value\": \"[[empty(parameters('BYOActionGroup'))]\",\n \"equals\": true\n },\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/actions.actionGroups[*].actionGroupId\",\n \"contains\": \"ag-AMBA-SH-\"\n }\n ]\n },\n {\n \"allOf\": [\n {\n \"value\": \"[[empty(parameters('BYOActionGroup'))]\",\n \"equals\": false\n },\n {\n \"count\": {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/actions.actionGroups[*]\",\n \"where\": {\n \"anyOf\": [\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/actions.actionGroups[*].actionGroupId\",\n \"in\": \"[[parameters('BYOActionGroup')]\"\n }\n ]\n }\n },\n \"greaterOrEquals\": 1\n }\n ]\n }\n ]\n },\n {\n \"count\": {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*]\",\n \"where\": {\n \"anyOf\": [\n {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].field\",\n \"equals\": \"category\"\n },\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].equals\",\n \"equals\": \"ServiceHealth\"\n }\n ]\n },\n {\n \"allOf\": [\n {\n \"field\": \"microsoft.insights/activityLogAlerts/condition.allOf[*].field\",\n \"equals\": \"properties.incidentType\"\n },\n {\n \"field\": \"microsoft.insights/activityLogAlerts/condition.allOf[*].equals\",\n \"equals\": \"Incident\"\n }\n ]\n }\n ]\n }\n },\n \"equals\": 2\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"enabled\": {\n \"type\": \"string\"\n },\n \"ALZMonitorActionGroupEmail\": {\n \"type\": \"Array\"\n },\n \"BYOActionGroup\": {\n \"type\": \"array\"\n }\n },\n \"variables\": {\n \"copy\": [\n {\n \"name\": \"varActionGroupIds\",\n \"count\": \"[[length(parameters('BYOActionGroup'))]\",\n \"mode\": \"serial\",\n \"input\": {\n \"actionGroupId\": \"[[trim(parameters('BYOActionGroup')[copyIndex('varActionGroupIds')])]\"\n }\n }\n ]\n },\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"ServiceHealthIncident\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[resourceId('Microsoft.Resources/resourceGroups', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"ALZMonitorActionGroupEmail\": {\n \"type\": \"Array\"\n },\n \"BYOActionGroup\": {\n \"type\": \"array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"condition\": \"[[empty(parameters('BYOActionGroup'))]\",\n \"type\": \"microsoft.insights/activityLogAlerts\",\n \"apiVersion\": \"2020-10-01\",\n \"name\": \"ServiceHealthIncident\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"actions\": {\n \"actionGroups\": [\n {\n \"actionGroupId\": \"[[concat(subscription().Id, '/resourceGroups/', parameters('alertResourceGroupName'), '/providers/microsoft.insights/actionGroups/', 'ag-AMBA-SH-', subscription().displayName, '-001')]\"\n }\n ]\n },\n \"description\": \"Service Health Incident Alert\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().id]\"\n ],\n \"condition\": {\n \"allOf\": [\n {\n \"field\": \"category\",\n \"equals\": \"ServiceHealth\"\n },\n {\n \"field\": \"properties.incidentType\",\n \"equals\": \"Incident\"\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n },\n {\n \"condition\": \"[[not(empty(parameters('BYOActionGroup')))]\",\n \"type\": \"microsoft.insights/activityLogAlerts\",\n \"apiVersion\": \"2020-10-01\",\n \"name\": \"ServiceHealthIncident\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"actions\": {\n \"actionGroups\": \"[[variables('varActionGroupIds')]\"\n },\n \"description\": \"Service Health Incident Alert\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().id]\"\n ],\n \"condition\": {\n \"allOf\": [\n {\n \"field\": \"category\",\n \"equals\": \"ServiceHealth\"\n },\n {\n \"field\": \"properties.incidentType\",\n \"equals\": \"Incident\"\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"ALZMonitorActionGroupEmail\": {\n \"value\": \"[[parameters('ALZMonitorActionGroupEmail')]\"\n },\n \"BYOActionGroup\": {\n \"value\": \"[[parameters('BYOActionGroup')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"ALZMonitorActionGroupEmail\": {\n \"value\": \"[[parameters('ALZMonitorActionGroupEmail')]\"\n },\n \"BYOActionGroup\": {\n \"value\": \"[[parameters('BYOActionGroup')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#4": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_activitylog_ServiceHealth_Maintenance\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Service Health Maintenance Alert\",\n \"description\": \"Policy to Deploy Service Health Maintenance Alert\",\n \"metadata\": {\n \"version\": \"1.3.0\",\n \"category\": \"Monitoring\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"_deployed_by_amba\": true\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"disabled\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n },\n \"ALZMonitorActionGroupEmail\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"Action Group Email Addresses\",\n \"description\": \"Email addresses to send alerts to\"\n },\n \"defaultValue\": []\n },\n \"BYOActionGroup\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Customer defined Action Group Resource IDs\",\n \"description\": \"The Resource IDs of existing Action Groups currently deployed in the environment.\"\n },\n \"defaultValue\": []\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Resources/subscriptions\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/activityLogAlerts\",\n \"existenceScope\": \"resourcegroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"anyOf\": [\n {\n \"allOf\": [\n {\n \"value\": \"[[empty(parameters('BYOActionGroup'))]\",\n \"equals\": true\n },\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/actions.actionGroups[*].actionGroupId\",\n \"contains\": \"ag-AMBA-SH-\"\n }\n ]\n },\n {\n \"allOf\": [\n {\n \"value\": \"[[empty(parameters('BYOActionGroup'))]\",\n \"equals\": false\n },\n {\n \"count\": {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/actions.actionGroups[*]\",\n \"where\": {\n \"anyOf\": [\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/actions.actionGroups[*].actionGroupId\",\n \"in\": \"[[parameters('BYOActionGroup')]\"\n }\n ]\n }\n },\n \"greaterOrEquals\": 1\n }\n ]\n }\n ]\n },\n {\n \"count\": {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*]\",\n \"where\": {\n \"anyOf\": [\n {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].field\",\n \"equals\": \"category\"\n },\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].equals\",\n \"equals\": \"ServiceHealth\"\n }\n ]\n },\n {\n \"allOf\": [\n {\n \"field\": \"microsoft.insights/activityLogAlerts/condition.allOf[*].field\",\n \"equals\": \"properties.incidentType\"\n },\n {\n \"field\": \"microsoft.insights/activityLogAlerts/condition.allOf[*].equals\",\n \"equals\": \"Maintenance\"\n }\n ]\n }\n ]\n }\n },\n \"equals\": 2\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"enabled\": {\n \"type\": \"string\"\n },\n \"ALZMonitorActionGroupEmail\": {\n \"type\": \"Array\"\n },\n \"BYOActionGroup\": {\n \"type\": \"array\"\n }\n },\n \"variables\": {\n \"copy\": [\n {\n \"name\": \"varActionGroupIds\",\n \"count\": \"[[length(parameters('BYOActionGroup'))]\",\n \"mode\": \"serial\",\n \"input\": {\n \"actionGroupId\": \"[[trim(parameters('BYOActionGroup')[copyIndex('varActionGroupIds')])]\"\n }\n }\n ]\n },\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"ServiceHealthMaintenance\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[resourceId('Microsoft.Resources/resourceGroups', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"ALZMonitorActionGroupEmail\": {\n \"type\": \"Array\"\n },\n \"BYOActionGroup\": {\n \"type\": \"array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"condition\": \"[[empty(parameters('BYOActionGroup'))]\",\n \"type\": \"microsoft.insights/activityLogAlerts\",\n \"apiVersion\": \"2020-10-01\",\n \"name\": \"ServiceHealthPlannedMaintenance\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"actions\": {\n \"actionGroups\": [\n {\n \"actionGroupId\": \"[[concat(subscription().Id, '/resourceGroups/', parameters('alertResourceGroupName'), '/providers/microsoft.insights/actionGroups/', 'ag-AMBA-SH-', subscription().displayName, '-001')]\"\n }\n ]\n },\n \"description\": \"Service Health Planned Maintenance Alert\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().id]\"\n ],\n \"condition\": {\n \"allOf\": [\n {\n \"field\": \"category\",\n \"equals\": \"ServiceHealth\"\n },\n {\n \"field\": \"properties.incidentType\",\n \"equals\": \"Maintenance\"\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n },\n {\n \"condition\": \"[[not(empty(parameters('BYOActionGroup')))]\",\n \"type\": \"microsoft.insights/activityLogAlerts\",\n \"apiVersion\": \"2020-10-01\",\n \"name\": \"ServiceHealthPlannedMaintenance\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"actions\": {\n \"actionGroups\": \"[[variables('varActionGroupIds')]\"\n },\n \"description\": \"Service Health Planned Maintenance Alert\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().id]\"\n ],\n \"condition\": {\n \"allOf\": [\n {\n \"field\": \"category\",\n \"equals\": \"ServiceHealth\"\n },\n {\n \"field\": \"properties.incidentType\",\n \"equals\": \"Maintenance\"\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"ALZMonitorActionGroupEmail\": {\n \"value\": \"[[parameters('ALZMonitorActionGroupEmail')]\"\n },\n \"BYOActionGroup\": {\n \"value\": \"[[parameters('BYOActionGroup')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"ALZMonitorActionGroupEmail\": {\n \"value\": \"[[parameters('ALZMonitorActionGroupEmail')]\"\n },\n \"BYOActionGroup\": {\n \"value\": \"[[parameters('BYOActionGroup')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#5": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_activitylog_ServiceHealth_SecurityAdvisory\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Service Health Security Advisory Alert\",\n \"description\": \"Policy to Deploy Service Health Security Advisory Alert\",\n \"metadata\": {\n \"version\": \"1.3.0\",\n \"category\": \"Monitoring\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"_deployed_by_amba\": true\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"disabled\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n },\n \"ALZMonitorActionGroupEmail\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"Action Group Email Addresses\",\n \"description\": \"Email addresses to send alerts to\"\n },\n \"defaultValue\": []\n },\n \"BYOActionGroup\": {\n \"type\": \"array\",\n \"metadata\": {\n \"displayName\": \"Customer defined Action Group Resource IDs\",\n \"description\": \"The Resource IDs of existing Action Groups currently deployed in the environment.\"\n },\n \"defaultValue\": []\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Resources/subscriptions\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/activityLogAlerts\",\n \"existenceScope\": \"resourcegroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"anyOf\": [\n {\n \"allOf\": [\n {\n \"value\": \"[[empty(parameters('BYOActionGroup'))]\",\n \"equals\": true\n },\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/actions.actionGroups[*].actionGroupId\",\n \"contains\": \"ag-AMBA-SH-\"\n }\n ]\n },\n {\n \"allOf\": [\n {\n \"value\": \"[[empty(parameters('BYOActionGroup'))]\",\n \"equals\": false\n },\n {\n \"count\": {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/actions.actionGroups[*]\",\n \"where\": {\n \"anyOf\": [\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/actions.actionGroups[*].actionGroupId\",\n \"in\": \"[[parameters('BYOActionGroup')]\"\n }\n ]\n }\n },\n \"greaterOrEquals\": 1\n }\n ]\n }\n ]\n },\n {\n \"count\": {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*]\",\n \"where\": {\n \"anyOf\": [\n {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].field\",\n \"equals\": \"category\"\n },\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].equals\",\n \"equals\": \"ServiceHealth\"\n }\n ]\n },\n {\n \"allOf\": [\n {\n \"field\": \"microsoft.insights/activityLogAlerts/condition.allOf[*].field\",\n \"equals\": \"properties.incidentType\"\n },\n {\n \"field\": \"microsoft.insights/activityLogAlerts/condition.allOf[*].equals\",\n \"equals\": \"Security\"\n }\n ]\n }\n ]\n }\n },\n \"equals\": 2\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"enabled\": {\n \"type\": \"string\"\n },\n \"ALZMonitorActionGroupEmail\": {\n \"type\": \"Array\"\n },\n \"BYOActionGroup\": {\n \"type\": \"array\"\n }\n },\n \"variables\": {\n \"copy\": [\n {\n \"name\": \"varActionGroupIds\",\n \"count\": \"[[length(parameters('BYOActionGroup'))]\",\n \"mode\": \"serial\",\n \"input\": {\n \"actionGroupId\": \"[[trim(parameters('BYOActionGroup')[copyIndex('varActionGroupIds')])]\"\n }\n }\n ]\n },\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"ServiceSecurityIncident\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[resourceId('Microsoft.Resources/resourceGroups', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"ALZMonitorActionGroupEmail\": {\n \"type\": \"Array\"\n },\n \"BYOActionGroup\": {\n \"type\": \"array\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"condition\": \"[[empty(parameters('BYOActionGroup'))]\",\n \"type\": \"microsoft.insights/activityLogAlerts\",\n \"apiVersion\": \"2020-10-01\",\n \"name\": \"ServiceHealthSecurityIncident\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"actions\": {\n \"actionGroups\": [\n {\n \"actionGroupId\": \"[[concat(subscription().Id, '/resourceGroups/', parameters('alertResourceGroupName'), '/providers/microsoft.insights/actionGroups/', 'ag-AMBA-SH-', subscription().displayName, '-001')]\"\n }\n ]\n },\n \"description\": \"Service Health Security Alert\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().id]\"\n ],\n \"condition\": {\n \"allOf\": [\n {\n \"field\": \"category\",\n \"equals\": \"ServiceHealth\"\n },\n {\n \"field\": \"properties.incidentType\",\n \"equals\": \"Security\"\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n },\n {\n \"condition\": \"[[not(empty(parameters('BYOActionGroup')))]\",\n \"type\": \"microsoft.insights/activityLogAlerts\",\n \"apiVersion\": \"2020-10-01\",\n \"name\": \"ServiceHealthSecurityIncident\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"actions\": {\n \"actionGroups\": \"[[variables('varActionGroupIds')]\"\n },\n \"description\": \"Service Health Security Alert\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().id]\"\n ],\n \"condition\": {\n \"allOf\": [\n {\n \"field\": \"category\",\n \"equals\": \"ServiceHealth\"\n },\n {\n \"field\": \"properties.incidentType\",\n \"equals\": \"Security\"\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"ALZMonitorActionGroupEmail\": {\n \"value\": \"[[parameters('ALZMonitorActionGroupEmail')]\"\n },\n \"BYOActionGroup\": {\n \"value\": \"[[parameters('BYOActionGroup')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n },\n \"ALZMonitorActionGroupEmail\": {\n \"value\": \"[[parameters('ALZMonitorActionGroupEmail')]\"\n },\n \"BYOActionGroup\": {\n \"value\": \"[[parameters('BYOActionGroup')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#6": { + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "name": "Alerting-ServiceHealth", + "properties": { + "displayName": "Deploy Azure Monitor Baseline Alerts for Service Health", + "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Service Health Events such as Service issues, Planned maintenance, Health advisories, Security advisories, and Resource health.", + "metadata": { + "version": "1.5.0", + "category": "Monitoring", + "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", + "alzCloudEnvironments": [ + "AzureCloud" + ], + "_deployed_by_amba": true + }, + "parameters": { + "ALZMonitorResourceGroupName": { + "type": "String", + "defaultValue": "ALZ-Monitoring-RG", + "metadata": { + "displayName": "Resource Group Name", + "description": "Name of the resource group to deploy the alerts to" + } + }, + "ALZMonitorResourceGroupTags": { + "type": "Object", + "defaultValue": { + "_deployed_by_alz_monitor": true + }, + "metadata": { + "displayName": "Resource Group Tags", + "description": "Tags to apply to the resource group" + } + }, + "ALZMonitorResourceGroupLocation": { + "type": "String", + "defaultValue": "centralus", + "metadata": { + "displayName": "Resource Group Location", + "description": "Location of the resource group" + } + }, + "ALZMonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": "MonitorDisable" + }, + "ALZMonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] + }, + "ResHlthUnhealthyAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Resource Health Unhealthy Alert State", + "description": "State of the Resource Health Unhealthy alert" + } + }, + "ResHlthUnhealthyPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Resource Health Unhealthy Alert Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "SvcHlthAdvisoryAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Service Health Advisory Alert State", + "description": "State of the Service Health Advisory alert" + } + }, + "serviceHealthAdvisoryPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Service Health Advisory Alert Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "SvcHlthIncidentAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Service Health Incident Alert State", + "description": "State of the Service Health Incident alert" + } + }, + "serviceHealthIncidentPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Service Health Incident Alert Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "SvcHlthMaintenanceAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Service Health Maintenance Alert State", + "description": "State of the Service Health Maintenance alert" + } + }, + "serviceHealthMaintenancePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Service Health Maintenance Alert Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "svcHlthSecAdvisoryAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Service Health Security Advisory Alert State", + "description": "State of the Service Health Security Advisory alert" + } + }, + "serviceHealthSecurityPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Service Health Security Advisory Alert Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "ALZMonitorActionGroupEmail": { + "type": "Array", + "defaultValue": [], + "metadata": { + "displayName": "Action Group Email Addresses", + "description": "Email addresses to send alerts to" + } + }, + "ALZLogicappResourceId": { + "type": "String", + "defaultValue": "", + "metadata": { + "displayName": "Logic App Resource Id", + "description": "Logic App Resource Id for Action Group to send alerts to" + } + }, + "ALZLogicappCallbackUrl": { + "type": "String", + "metadata": { + "displayName": "Logic App Callback URL", + "description": "Callback URL that triggers the Logic App" + }, + "defaultValue": "" + }, + "ALZArmRoleId": { + "type": "array", + "defaultValue": [], + "metadata": { + "displayName": "Arm Role Ids", + "description": "Arm Built-in Role Ids for action group to send alerts to" + } + }, + "ALZEventHubResourceId": { + "type": "array", + "defaultValue": [], + "metadata": { + "displayName": "Event Hub resource Ids", + "description": "Event Hub resource Ids for action group to send alerts to" + } + }, + "ALZWebhookServiceUri": { + "type": "Array", + "metadata": { + "displayName": "Webhook Service Uri(s)", + "description": "Indicates the service uri(s) of the webhook to send alerts to" + }, + "defaultValue": [] + }, + "ALZFunctionResourceId": { + "type": "String", + "metadata": { + "displayName": "Function Resource Id", + "description": "Function Resource Id for Action Group to send alerts to" + }, + "defaultValue": "" + }, + "ALZFunctionTriggerUrl": { + "type": "String", + "metadata": { + "displayName": "Function Trigger URL", + "description": "URL that triggers the Function App" + }, + "defaultValue": "" + }, + "BYOActionGroup": { + "type": "array", + "metadata": { + "displayName": "Customer defined Action Group Resource IDs", + "description": "The Resource IDs of existing Action Groups currently deployed in the environment." + }, + "defaultValue": [] + }, + "BYOAlertProcessingRule": { + "type": "String", + "metadata": { + "displayName": "Customer defined Alert Processing Rule Resource ID", + "description": "The Resource ID of an existing Alert Processing Rule already deployed by the customer in his environment" + }, + "defaultValue": "" + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "ALZ_ServiceHealth_ActionGroups", + "policyDefinitionId": "[[concat('/providers/Microsoft.Management/managementGroups/contoso', '/providers/Microsoft.Authorization/policyDefinitions/Deploy_ServiceHealth_ActionGroups')]", + "parameters": { + "ALZMonitorResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "ALZMonitorResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "ALZMonitorResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "ALZMonitorActionGroupEmail": { + "value": "[[[parameters('ALZMonitorActionGroupEmail')]" + }, + "ALZLogicappResourceId": { + "value": "[[[parameters('ALZLogicappResourceId')]" + }, + "ALZLogicappCallbackUrl": { + "value": "[[[parameters('ALZLogicappCallbackUrl')]" + }, + "ALZArmRoleId": { + "value": "[[[parameters('ALZArmRoleId')]" + }, + "ALZEventHubResourceId": { + "value": "[[[parameters('ALZEventHubResourceId')]" + }, + "ALZWebhookServiceUri": { + "value": "[[[parameters('ALZWebhookServiceUri')]" + }, + "ALZFunctionResourceId": { + "value": "[[[parameters('ALZFunctionResourceId')]" + }, + "ALZFunctionTriggerUrl": { + "value": "[[[parameters('ALZFunctionTriggerUrl')]" + }, + "BYOActionGroup": { + "value": "[[[parameters('BYOActionGroup')]" + }, + "BYOAlertProcessingRule": { + "value": "[[[parameters('BYOAlertProcessingRule')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_ResHlthUnhealthy", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_ResourceHealth_Unhealthy_Alert", + "parameters": { + "enabled": { + "value": "[[[parameters('ResHlthUnhealthyAlertState')]" + }, + "effect": { + "value": "[[[parameters('ResHlthUnhealthyPolicyEffect')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "BYOActionGroup": { + "value": "[[[parameters('BYOActionGroup')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_SvcHlthAdvisory", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_ServiceHealth_HealthAdvisory", + "parameters": { + "enabled": { + "value": "[[[parameters('SvcHlthAdvisoryAlertState')]" + }, + "effect": { + "value": "[[[parameters('serviceHealthAdvisoryPolicyEffect')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "ALZMonitorActionGroupEmail": { + "value": "[[[parameters('ALZMonitorActionGroupEmail')]" + }, + "BYOActionGroup": { + "value": "[[[parameters('BYOActionGroup')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_SvcHlthIncident", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_ServiceHealth_Incident", + "parameters": { + "enabled": { + "value": "[[[parameters('SvcHlthIncidentAlertState')]" + }, + "effect": { + "value": "[[[parameters('serviceHealthIncidentPolicyEffect')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "ALZMonitorActionGroupEmail": { + "value": "[[[parameters('ALZMonitorActionGroupEmail')]" + }, + "BYOActionGroup": { + "value": "[[[parameters('BYOActionGroup')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_SvcHlthMaintenance", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_ServiceHealth_Maintenance", + "parameters": { + "enabled": { + "value": "[[[parameters('SvcHlthMaintenanceAlertState')]" + }, + "effect": { + "value": "[[[parameters('serviceHealthMaintenancePolicyEffect')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "BYOActionGroup": { + "value": "[[[parameters('BYOActionGroup')]" + }, + "ALZMonitorActionGroupEmail": { + "value": "[[[parameters('ALZMonitorActionGroupEmail')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_svcHlthSecAdvisory", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_ServiceHealth_SecurityAdvisory", + "parameters": { + "enabled": { + "value": "[[[parameters('svcHlthSecAdvisoryAlertState')]" + }, + "effect": { + "value": "[[[parameters('serviceHealthSecurityPolicyEffect')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "ALZMonitorActionGroupEmail": { + "value": "[[[parameters('ALZMonitorActionGroupEmail')]" + }, + "BYOActionGroup": { + "value": "[[[parameters('BYOActionGroup')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + } + ], + "policyType": "Custom", + "policyDefinitionGroups": null + } + }, + "cloudEnv": "[environment().name]", + "defaultDeploymentLocationByCloudType": { + "AzureCloud": "northeurope", + "AzureChinaCloud": "chinaeast2", + "AzureUSGovernment": "usgovvirginia" + }, + "templateVars": { + "scope": "/providers/Microsoft.Management/managementGroups/contoso", + "defaultDeploymentLocation": "\"location\": \"northeurope\"", + "localizedDeploymentLocation": "[format('\"location\": \"{0}\"', variables('defaultDeploymentLocationByCloudType')[variables('cloudEnv')])]" + }, + "targetDeploymentLocationByCloudType": { + "AzureCloud": "[coalesce(parameters('location'), 'northeurope')]", + "AzureChinaCloud": "[coalesce(parameters('location'), 'chinaeast2')]", + "AzureUSGovernment": "[coalesce(parameters('location'), 'usgovvirginia')]" + }, + "deploymentLocation": "[format('\"location\": \"{0}\"', variables('targetDeploymentLocationByCloudType')[variables('cloudEnv')])]", + "loadPolicyDefinitions": { + "All": [ + "[variables('$fxv#0')]", + "[variables('$fxv#1')]", + "[variables('$fxv#2')]", + "[variables('$fxv#3')]", + "[variables('$fxv#4')]", + "[variables('$fxv#5')]" + ], + "AzureCloud": [], + "AzureChinaCloud": [], + "AzureUSGovernment": [] + }, + "loadPolicySetDefinitions": { + "All": [ + "[string(variables('$fxv#6'))]" + ], + "AzureCloud": [], + "AzureChinaCloud": [], + "AzureUSGovernment": [] + }, + "policyDefinitionsByCloudType": { + "All": "[variables('policyDefinitionsAll')]", + "AzureCloud": "[variables('policyDefinitionsAzureCloud')]", + "AzureChinaCloud": "[variables('policyDefinitionsAzureChinaCloud')]", + "AzureUSGovernment": "[variables('policyDefinitionsAzureUSGovernment')]" + }, + "policySetDefinitionsByCloudType": { + "All": "[variables('policySetDefinitionsAll')]", + "AzureCloud": "[variables('policySetDefinitionsAzureCloud')]", + "AzureChinaCloud": "[variables('policySetDefinitionsAzureChinaCloud')]", + "AzureUSGovernment": "[variables('policySetDefinitionsAzureUSGovernment')]" + }, + "policyDefinitions": "[concat(variables('policyDefinitionsByCloudType').All, variables('policyDefinitionsByCloudType')[variables('cloudEnv')])]", + "policySetDefinitions": "[concat(variables('policySetDefinitionsByCloudType').All, variables('policySetDefinitionsByCloudType')[variables('cloudEnv')])]" + }, + "resources": [ + { + "copy": { + "name": "PolicyDefinitions", + "count": "[length(variables('policyDefinitions'))]" + }, + "type": "Microsoft.Authorization/policyDefinitions", + "apiVersion": "2020-09-01", + "name": "[variables('policyDefinitions')[copyIndex()].name]", + "properties": { + "description": "[variables('policyDefinitions')[copyIndex()].properties.description]", + "displayName": "[variables('policyDefinitions')[copyIndex()].properties.displayName]", + "metadata": "[variables('policyDefinitions')[copyIndex()].properties.metadata]", + "mode": "[variables('policyDefinitions')[copyIndex()].properties.mode]", + "parameters": "[variables('policyDefinitions')[copyIndex()].properties.parameters]", + "policyType": "[variables('policyDefinitions')[copyIndex()].properties.policyType]", + "policyRule": "[variables('policyDefinitions')[copyIndex()].properties.policyRule]" + } + }, + { + "copy": { + "name": "PolicySetDefinitions", + "count": "[length(variables('policySetDefinitions'))]" + }, + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2020-09-01", + "name": "[variables('policySetDefinitions')[copyIndex()].name]", + "properties": { + "description": "[variables('policySetDefinitions')[copyIndex()].properties.description]", + "displayName": "[variables('policySetDefinitions')[copyIndex()].properties.displayName]", + "metadata": "[variables('policySetDefinitions')[copyIndex()].properties.metadata]", + "parameters": "[variables('policySetDefinitions')[copyIndex()].properties.parameters]", + "policyType": "[variables('policySetDefinitions')[copyIndex()].properties.policyType]", + "policyDefinitions": "[variables('policySetDefinitions')[copyIndex()].properties.policyDefinitions]", + "policyDefinitionGroups": "[variables('policySetDefinitions')[copyIndex()].properties.policyDefinitionGroups]" + }, + "dependsOn": [ + "PolicyDefinitions" + ] + } + ], + "outputs": { + "policyDefinitionNames": { + "type": "array", + "copy": { + "count": "[length(variables('policyDefinitions'))]", + "input": "[variables('policyDefinitions')[copyIndex()].name]" + } + }, + "policySetDefinitionNames": { + "type": "array", + "copy": { + "count": "[length(variables('policySetDefinitions'))]", + "input": "[variables('policySetDefinitions')[copyIndex()].name]" + } + } + } +} \ No newline at end of file diff --git a/patterns/alz/policyDefinitions/policies-Storage.json b/patterns/alz/policyDefinitions/policies-Storage.json new file mode 100644 index 000000000..e6c22d1a9 --- /dev/null +++ b/patterns/alz/policyDefinitions/policies-Storage.json @@ -0,0 +1,450 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-08-01/managementGroupDeploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.29.47.4906", + "templateHash": "6488828852570161518" + } + }, + "parameters": { + "topLevelManagementGroupPrefix": { + "type": "string", + "defaultValue": "alz", + "metadata": { + "message": "The JSON version of this file is programatically generated from Bicep. PLEASE DO NOT UPDATE MANUALLY!!", + "description": "Provide a prefix (unique at tenant-scope) for the Management Group hierarchy and other resources created as part of an Azure landing zone. DEFAULT VALUE = \"alz\"" + } + }, + "location": { + "type": "string", + "defaultValue": "[deployment().location]", + "metadata": { + "description": "Optionally set the deployment location for policies with Deploy If Not Exists effect. DEFAULT VALUE = \"deployment().location\"" + } + }, + "scope": { + "type": "string", + "defaultValue": "[tenantResourceId('Microsoft.Management/managementGroups', parameters('topLevelManagementGroupPrefix'))]", + "metadata": { + "description": "Optionally set the scope for custom Policy Definitions used in Policy Set Definitions (Initiatives). Must be one of '/', '/subscriptions/id' or '/providers/Microsoft.Management/managementGroups/id'. DEFAULT VALUE = '/providers/Microsoft.Management/managementGroups/${topLevelManagementGroupPrefix}'" + } + } + }, + "variables": { + "copy": [ + { + "name": "processPolicyDefinitionsAll", + "count": "[length(variables('loadPolicyDefinitions').All)]", + "input": "[replace(replace(variables('loadPolicyDefinitions').All[copyIndex('processPolicyDefinitionsAll')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" + }, + { + "name": "processPolicyDefinitionsAzureCloud", + "count": "[length(variables('loadPolicyDefinitions').AzureCloud)]", + "input": "[replace(replace(variables('loadPolicyDefinitions').AzureCloud[copyIndex('processPolicyDefinitionsAzureCloud')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" + }, + { + "name": "processPolicyDefinitionsAzureChinaCloud", + "count": "[length(variables('loadPolicyDefinitions').AzureChinaCloud)]", + "input": "[replace(replace(variables('loadPolicyDefinitions').AzureChinaCloud[copyIndex('processPolicyDefinitionsAzureChinaCloud')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" + }, + { + "name": "processPolicyDefinitionsAzureUSGovernment", + "count": "[length(variables('loadPolicyDefinitions').AzureUSGovernment)]", + "input": "[replace(replace(variables('loadPolicyDefinitions').AzureUSGovernment[copyIndex('processPolicyDefinitionsAzureUSGovernment')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" + }, + { + "name": "processPolicySetDefinitionsAll", + "count": "[length(variables('loadPolicySetDefinitions').All)]", + "input": "[replace(variables('loadPolicySetDefinitions').All[copyIndex('processPolicySetDefinitionsAll')], variables('templateVars').scope, parameters('scope'))]" + }, + { + "name": "processPolicySetDefinitionsAzureCloud", + "count": "[length(variables('loadPolicySetDefinitions').AzureCloud)]", + "input": "[replace(variables('loadPolicySetDefinitions').AzureCloud[copyIndex('processPolicySetDefinitionsAzureCloud')], variables('templateVars').scope, parameters('scope'))]" + }, + { + "name": "processPolicySetDefinitionsAzureChinaCloud", + "count": "[length(variables('loadPolicySetDefinitions').AzureChinaCloud)]", + "input": "[replace(variables('loadPolicySetDefinitions').AzureChinaCloud[copyIndex('processPolicySetDefinitionsAzureChinaCloud')], variables('templateVars').scope, parameters('scope'))]" + }, + { + "name": "processPolicySetDefinitionsAzureUSGovernment", + "count": "[length(variables('loadPolicySetDefinitions').AzureUSGovernment)]", + "input": "[replace(variables('loadPolicySetDefinitions').AzureUSGovernment[copyIndex('processPolicySetDefinitionsAzureUSGovernment')], variables('templateVars').scope, parameters('scope'))]" + }, + { + "name": "policyDefinitionsAll", + "count": "[length(variables('processPolicyDefinitionsAll'))]", + "input": "[json(variables('processPolicyDefinitionsAll')[copyIndex('policyDefinitionsAll')])]" + }, + { + "name": "policyDefinitionsAzureCloud", + "count": "[length(variables('processPolicyDefinitionsAzureCloud'))]", + "input": "[json(variables('processPolicyDefinitionsAzureCloud')[copyIndex('policyDefinitionsAzureCloud')])]" + }, + { + "name": "policyDefinitionsAzureChinaCloud", + "count": "[length(variables('processPolicyDefinitionsAzureChinaCloud'))]", + "input": "[json(variables('processPolicyDefinitionsAzureChinaCloud')[copyIndex('policyDefinitionsAzureChinaCloud')])]" + }, + { + "name": "policyDefinitionsAzureUSGovernment", + "count": "[length(variables('processPolicyDefinitionsAzureUSGovernment'))]", + "input": "[json(variables('processPolicyDefinitionsAzureUSGovernment')[copyIndex('policyDefinitionsAzureUSGovernment')])]" + }, + { + "name": "policySetDefinitionsAll", + "count": "[length(variables('processPolicySetDefinitionsAll'))]", + "input": "[json(variables('processPolicySetDefinitionsAll')[copyIndex('policySetDefinitionsAll')])]" + }, + { + "name": "policySetDefinitionsAzureCloud", + "count": "[length(variables('processPolicySetDefinitionsAzureCloud'))]", + "input": "[json(variables('processPolicySetDefinitionsAzureCloud')[copyIndex('policySetDefinitionsAzureCloud')])]" + }, + { + "name": "policySetDefinitionsAzureChinaCloud", + "count": "[length(variables('processPolicySetDefinitionsAzureChinaCloud'))]", + "input": "[json(variables('processPolicySetDefinitionsAzureChinaCloud')[copyIndex('policySetDefinitionsAzureChinaCloud')])]" + }, + { + "name": "policySetDefinitionsAzureUSGovernment", + "count": "[length(variables('processPolicySetDefinitionsAzureUSGovernment'))]", + "input": "[json(variables('processPolicySetDefinitionsAzureUSGovernment')[copyIndex('policySetDefinitionsAzureUSGovernment')])]" + } + ], + "$fxv#0": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_StorageAccount_Availability_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy SA Availability Alert\",\n \"description\": \"Policy to audit/deploy SA Availability Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Storage\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"1\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"90\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Storage/storageAccounts\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Storage/storageAccounts\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"Availability\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Storage/storageAccounts/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\n \"equals\": \"LessThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-Availability-threshold-Override_'), field('tags._amba-Availability-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-AvailabilityAlert')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for Storage Account Availability\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"Availability\",\n \"metricNamespace\": \"Microsoft.Storage/storageAccounts\",\n \"metricName\": \"Availability\",\n \"operator\": \"LessThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-Availability-threshold-Override_'), field('tags._amba-Availability-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#1": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_activitylog_StorageAccount_Delete\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy Activity Log Storage Account Delete Alert\",\n \"description\": \"Policy to Deploy Activity Log Storage Account Delete Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Monitoring\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Name\",\n \"description\": \"Resource group the alert is placed in\"\n },\n \"defaultValue\": \"rg-amba-monitoring-001\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"Object\",\n \"metadata\": {\n \"displayName\": \"Resource Group Tags\",\n \"description\": \"Tags on the Resource group the alert is placed in\"\n },\n \"defaultValue\": {\n \"_deployed_by_amba\": true\n }\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Resource Group Location\",\n \"description\": \"Location of the Resource group the alert is placed in\"\n },\n \"defaultValue\": \"centralus\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name to disable monitoring on resource. Set to true if monitoring should be disabled\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Storage/storageAccounts\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/activityLogAlerts\",\n \"name\": \"Activity Log Storage Account Delete\",\n \"existenceScope\": \"resourcegroup\",\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\n \"deploymentScope\": \"subscription\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"count\": {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*]\",\n \"where\": {\n \"anyOf\": [\n {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].field\",\n \"equals\": \"category\"\n },\n {\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].equals\",\n \"equals\": \"Administrative\"\n }\n ]\n },\n {\n \"allOf\": [\n {\n \"field\": \"microsoft.insights/activityLogAlerts/condition.allOf[*].field\",\n \"equals\": \"operationName\"\n },\n {\n \"field\": \"microsoft.insights/activityLogAlerts/condition.allOf[*].equals\",\n \"equals\": \"Microsoft.Storage/storageAccounts/delete\"\n }\n ]\n }\n ]\n }\n },\n \"equals\": 2\n }\n ]\n },\n \"deployment\": {\n \"location\": \"northeurope\",\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupTags\": {\n \"type\": \"object\"\n },\n \"alertResourceGroupLocation\": {\n \"type\": \"string\"\n },\n \"enabled\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Resources/resourceGroups\",\n \"apiVersion\": \"2021-04-01\",\n \"name\": \"[[parameters('alertResourceGroupName')]\",\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\n },\n {\n \"type\": \"Microsoft.Resources/deployments\",\n \"apiVersion\": \"2019-10-01\",\n \"name\": \"ActivitySADelete\",\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\n \"dependsOn\": [\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\n ],\n \"properties\": {\n \"mode\": \"Incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"enabled\": {\n \"type\": \"string\"\n },\n \"alertResourceGroupName\": {\n \"type\": \"string\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"microsoft.insights/activityLogAlerts\",\n \"apiVersion\": \"2020-10-01\",\n \"name\": \"Activity Log Storage Account Delete\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Activity Log Storage Account Delete\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[subscription().id]\"\n ],\n \"condition\": {\n \"allOf\": [\n {\n \"field\": \"category\",\n \"equals\": \"Administrative\"\n },\n {\n \"field\": \"operationName\",\n \"equals\": \"Microsoft.Storage/storageAccounts/delete\"\n },\n {\n \"field\": \"status\",\n \"containsAny\": [\n \"succeeded\"\n ]\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"alertResourceGroupName\": {\n \"value\": \"[[parameters('alertResourceGroupName')]\"\n },\n \"alertResourceGroupTags\": {\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\n },\n \"alertResourceGroupLocation\": {\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#2": { + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "name": "Alerting-Storage", + "properties": { + "displayName": "Deploy Azure Monitor Baseline Alerts for Storage", + "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Storage Services such as Storage accounts.", + "metadata": { + "version": "1.0.0", + "category": "Monitoring", + "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", + "alzCloudEnvironments": [ + "AzureCloud" + ], + "_deployed_by_amba": true + }, + "parameters": { + "ALZMonitorResourceGroupName": { + "type": "String", + "defaultValue": "ALZ-Monitoring-RG", + "metadata": { + "displayName": "ALZ Monitor Resource Group Name", + "description": "Name of the resource group where the ALZ Monitor resources will be deployed" + } + }, + "ALZMonitorResourceGroupTags": { + "type": "Object", + "defaultValue": { + "_deployed_by_alz_monitor": true + }, + "metadata": { + "displayName": "ALZ Monitor Resource Group Tags", + "description": "Tags for the resource group where the ALZ Monitor resources will be deployed" + } + }, + "ALZMonitorResourceGroupLocation": { + "type": "String", + "defaultValue": "centralus", + "metadata": { + "displayName": "ALZ Monitor Resource Group Location", + "description": "Location of the resource group where the ALZ Monitor resources will be deployed" + } + }, + "ALZMonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": "MonitorDisable" + }, + "ALZMonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] + }, + "StorageAccountAvailabilityAlertSeverity": { + "type": "String", + "defaultValue": "1", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "Storage Account Availability Alert Severity", + "description": "Severity of the alert for Storage Account Availability" + } + }, + "StorageAccountAvailabilityWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "Storage Account Availability Window Size", + "description": "Window size for the alert" + } + }, + "StorageAccountAvailabilityFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "Storage Account Availability Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "StorageAccountAvailabilityPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Storage Account Availability Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "StorageAccountAvailabilityAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Storage Account Availability Alert State", + "description": "Alert state for the alert" + } + }, + "StorageAccountAvailabilityThreshold": { + "type": "string", + "defaultValue": "90", + "metadata": { + "displayName": "Storage Account Availability Threshold", + "description": "Threshold for the alert" + } + }, + "StorageAccountDeletePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Storage Account Delete Alert Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will create the alert if it does not exist, disabled will not create the alert" + } + }, + "StorageAccountDeleteAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Storage Account Delete Alert State", + "description": "Alert state for the alert" + } + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "ALZ_StorageAccountAvailability", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_StorageAccount_Availability_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('StorageAccountAvailabilityAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('StorageAccountAvailabilityWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('StorageAccountAvailabilityFrequency')]" + }, + "effect": { + "value": "[[[parameters('StorageAccountAvailabilityPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('StorageAccountAvailabilityAlertState')]" + }, + "threshold": { + "value": "[[[parameters('StorageAccountAvailabilityThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_activitySADelete", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_StorageAccount_Delete", + "parameters": { + "effect": { + "value": "[[[parameters('StorageAccountDeletePolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('StorageAccountDeleteAlertState')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + } + ], + "policyType": "Custom", + "policyDefinitionGroups": null + } + }, + "cloudEnv": "[environment().name]", + "defaultDeploymentLocationByCloudType": { + "AzureCloud": "northeurope", + "AzureChinaCloud": "chinaeast2", + "AzureUSGovernment": "usgovvirginia" + }, + "templateVars": { + "scope": "/providers/Microsoft.Management/managementGroups/contoso", + "defaultDeploymentLocation": "\"location\": \"northeurope\"", + "localizedDeploymentLocation": "[format('\"location\": \"{0}\"', variables('defaultDeploymentLocationByCloudType')[variables('cloudEnv')])]" + }, + "targetDeploymentLocationByCloudType": { + "AzureCloud": "[coalesce(parameters('location'), 'northeurope')]", + "AzureChinaCloud": "[coalesce(parameters('location'), 'chinaeast2')]", + "AzureUSGovernment": "[coalesce(parameters('location'), 'usgovvirginia')]" + }, + "deploymentLocation": "[format('\"location\": \"{0}\"', variables('targetDeploymentLocationByCloudType')[variables('cloudEnv')])]", + "loadPolicyDefinitions": { + "All": [ + "[variables('$fxv#0')]", + "[variables('$fxv#1')]" + ], + "AzureCloud": [], + "AzureChinaCloud": [], + "AzureUSGovernment": [] + }, + "loadPolicySetDefinitions": { + "All": [ + "[string(variables('$fxv#2'))]" + ], + "AzureCloud": [], + "AzureChinaCloud": [], + "AzureUSGovernment": [] + }, + "policyDefinitionsByCloudType": { + "All": "[variables('policyDefinitionsAll')]", + "AzureCloud": "[variables('policyDefinitionsAzureCloud')]", + "AzureChinaCloud": "[variables('policyDefinitionsAzureChinaCloud')]", + "AzureUSGovernment": "[variables('policyDefinitionsAzureUSGovernment')]" + }, + "policySetDefinitionsByCloudType": { + "All": "[variables('policySetDefinitionsAll')]", + "AzureCloud": "[variables('policySetDefinitionsAzureCloud')]", + "AzureChinaCloud": "[variables('policySetDefinitionsAzureChinaCloud')]", + "AzureUSGovernment": "[variables('policySetDefinitionsAzureUSGovernment')]" + }, + "policyDefinitions": "[concat(variables('policyDefinitionsByCloudType').All, variables('policyDefinitionsByCloudType')[variables('cloudEnv')])]", + "policySetDefinitions": "[concat(variables('policySetDefinitionsByCloudType').All, variables('policySetDefinitionsByCloudType')[variables('cloudEnv')])]" + }, + "resources": [ + { + "copy": { + "name": "PolicyDefinitions", + "count": "[length(variables('policyDefinitions'))]" + }, + "type": "Microsoft.Authorization/policyDefinitions", + "apiVersion": "2020-09-01", + "name": "[variables('policyDefinitions')[copyIndex()].name]", + "properties": { + "description": "[variables('policyDefinitions')[copyIndex()].properties.description]", + "displayName": "[variables('policyDefinitions')[copyIndex()].properties.displayName]", + "metadata": "[variables('policyDefinitions')[copyIndex()].properties.metadata]", + "mode": "[variables('policyDefinitions')[copyIndex()].properties.mode]", + "parameters": "[variables('policyDefinitions')[copyIndex()].properties.parameters]", + "policyType": "[variables('policyDefinitions')[copyIndex()].properties.policyType]", + "policyRule": "[variables('policyDefinitions')[copyIndex()].properties.policyRule]" + } + }, + { + "copy": { + "name": "PolicySetDefinitions", + "count": "[length(variables('policySetDefinitions'))]" + }, + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2020-09-01", + "name": "[variables('policySetDefinitions')[copyIndex()].name]", + "properties": { + "description": "[variables('policySetDefinitions')[copyIndex()].properties.description]", + "displayName": "[variables('policySetDefinitions')[copyIndex()].properties.displayName]", + "metadata": "[variables('policySetDefinitions')[copyIndex()].properties.metadata]", + "parameters": "[variables('policySetDefinitions')[copyIndex()].properties.parameters]", + "policyType": "[variables('policySetDefinitions')[copyIndex()].properties.policyType]", + "policyDefinitions": "[variables('policySetDefinitions')[copyIndex()].properties.policyDefinitions]", + "policyDefinitionGroups": "[variables('policySetDefinitions')[copyIndex()].properties.policyDefinitionGroups]" + }, + "dependsOn": [ + "PolicyDefinitions" + ] + } + ], + "outputs": { + "policyDefinitionNames": { + "type": "array", + "copy": { + "count": "[length(variables('policyDefinitions'))]", + "input": "[variables('policyDefinitions')[copyIndex()].name]" + } + }, + "policySetDefinitionNames": { + "type": "array", + "copy": { + "count": "[length(variables('policySetDefinitions'))]", + "input": "[variables('policySetDefinitions')[copyIndex()].name]" + } + } + } +} \ No newline at end of file diff --git a/patterns/alz/policyDefinitions/policies-Web.json b/patterns/alz/policyDefinitions/policies-Web.json new file mode 100644 index 000000000..f27c46a5c --- /dev/null +++ b/patterns/alz/policyDefinitions/policies-Web.json @@ -0,0 +1,677 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-08-01/managementGroupDeploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.29.47.4906", + "templateHash": "6170361127055992686" + } + }, + "parameters": { + "topLevelManagementGroupPrefix": { + "type": "string", + "defaultValue": "alz", + "metadata": { + "message": "The JSON version of this file is programatically generated from Bicep. PLEASE DO NOT UPDATE MANUALLY!!", + "description": "Provide a prefix (unique at tenant-scope) for the Management Group hierarchy and other resources created as part of an Azure landing zone. DEFAULT VALUE = \"alz\"" + } + }, + "location": { + "type": "string", + "defaultValue": "[deployment().location]", + "metadata": { + "description": "Optionally set the deployment location for policies with Deploy If Not Exists effect. DEFAULT VALUE = \"deployment().location\"" + } + }, + "scope": { + "type": "string", + "defaultValue": "[tenantResourceId('Microsoft.Management/managementGroups', parameters('topLevelManagementGroupPrefix'))]", + "metadata": { + "description": "Optionally set the scope for custom Policy Definitions used in Policy Set Definitions (Initiatives). Must be one of '/', '/subscriptions/id' or '/providers/Microsoft.Management/managementGroups/id'. DEFAULT VALUE = '/providers/Microsoft.Management/managementGroups/${topLevelManagementGroupPrefix}'" + } + } + }, + "variables": { + "copy": [ + { + "name": "processPolicyDefinitionsAll", + "count": "[length(variables('loadPolicyDefinitions').All)]", + "input": "[replace(replace(variables('loadPolicyDefinitions').All[copyIndex('processPolicyDefinitionsAll')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" + }, + { + "name": "processPolicyDefinitionsAzureCloud", + "count": "[length(variables('loadPolicyDefinitions').AzureCloud)]", + "input": "[replace(replace(variables('loadPolicyDefinitions').AzureCloud[copyIndex('processPolicyDefinitionsAzureCloud')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" + }, + { + "name": "processPolicyDefinitionsAzureChinaCloud", + "count": "[length(variables('loadPolicyDefinitions').AzureChinaCloud)]", + "input": "[replace(replace(variables('loadPolicyDefinitions').AzureChinaCloud[copyIndex('processPolicyDefinitionsAzureChinaCloud')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" + }, + { + "name": "processPolicyDefinitionsAzureUSGovernment", + "count": "[length(variables('loadPolicyDefinitions').AzureUSGovernment)]", + "input": "[replace(replace(variables('loadPolicyDefinitions').AzureUSGovernment[copyIndex('processPolicyDefinitionsAzureUSGovernment')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" + }, + { + "name": "processPolicySetDefinitionsAll", + "count": "[length(variables('loadPolicySetDefinitions').All)]", + "input": "[replace(variables('loadPolicySetDefinitions').All[copyIndex('processPolicySetDefinitionsAll')], variables('templateVars').scope, parameters('scope'))]" + }, + { + "name": "processPolicySetDefinitionsAzureCloud", + "count": "[length(variables('loadPolicySetDefinitions').AzureCloud)]", + "input": "[replace(variables('loadPolicySetDefinitions').AzureCloud[copyIndex('processPolicySetDefinitionsAzureCloud')], variables('templateVars').scope, parameters('scope'))]" + }, + { + "name": "processPolicySetDefinitionsAzureChinaCloud", + "count": "[length(variables('loadPolicySetDefinitions').AzureChinaCloud)]", + "input": "[replace(variables('loadPolicySetDefinitions').AzureChinaCloud[copyIndex('processPolicySetDefinitionsAzureChinaCloud')], variables('templateVars').scope, parameters('scope'))]" + }, + { + "name": "processPolicySetDefinitionsAzureUSGovernment", + "count": "[length(variables('loadPolicySetDefinitions').AzureUSGovernment)]", + "input": "[replace(variables('loadPolicySetDefinitions').AzureUSGovernment[copyIndex('processPolicySetDefinitionsAzureUSGovernment')], variables('templateVars').scope, parameters('scope'))]" + }, + { + "name": "policyDefinitionsAll", + "count": "[length(variables('processPolicyDefinitionsAll'))]", + "input": "[json(variables('processPolicyDefinitionsAll')[copyIndex('policyDefinitionsAll')])]" + }, + { + "name": "policyDefinitionsAzureCloud", + "count": "[length(variables('processPolicyDefinitionsAzureCloud'))]", + "input": "[json(variables('processPolicyDefinitionsAzureCloud')[copyIndex('policyDefinitionsAzureCloud')])]" + }, + { + "name": "policyDefinitionsAzureChinaCloud", + "count": "[length(variables('processPolicyDefinitionsAzureChinaCloud'))]", + "input": "[json(variables('processPolicyDefinitionsAzureChinaCloud')[copyIndex('policyDefinitionsAzureChinaCloud')])]" + }, + { + "name": "policyDefinitionsAzureUSGovernment", + "count": "[length(variables('processPolicyDefinitionsAzureUSGovernment'))]", + "input": "[json(variables('processPolicyDefinitionsAzureUSGovernment')[copyIndex('policyDefinitionsAzureUSGovernment')])]" + }, + { + "name": "policySetDefinitionsAll", + "count": "[length(variables('processPolicySetDefinitionsAll'))]", + "input": "[json(variables('processPolicySetDefinitionsAll')[copyIndex('policySetDefinitionsAll')])]" + }, + { + "name": "policySetDefinitionsAzureCloud", + "count": "[length(variables('processPolicySetDefinitionsAzureCloud'))]", + "input": "[json(variables('processPolicySetDefinitionsAzureCloud')[copyIndex('policySetDefinitionsAzureCloud')])]" + }, + { + "name": "policySetDefinitionsAzureChinaCloud", + "count": "[length(variables('processPolicySetDefinitionsAzureChinaCloud'))]", + "input": "[json(variables('processPolicySetDefinitionsAzureChinaCloud')[copyIndex('policySetDefinitionsAzureChinaCloud')])]" + }, + { + "name": "policySetDefinitionsAzureUSGovernment", + "count": "[length(variables('processPolicySetDefinitionsAzureUSGovernment'))]", + "input": "[json(variables('processPolicySetDefinitionsAzureUSGovernment')[copyIndex('policySetDefinitionsAzureUSGovernment')])]" + } + ], + "$fxv#0": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_WSF_CPUPercentage_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy App Service Plan CPU Percentage Alert\",\n \"description\": \"Policy to audit/deploy App Service Plan CPU Percentage Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"Category\": \"Web Services\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"90\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Web/serverfarms\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Web/serverfarms\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"CpuPercentage\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Web/serverfarms/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\n \"equals\": \"GreaterThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-CpuPercentage-threshold-Override_'), field('tags._amba-CpuPercentage-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-CpuPercentage')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for App Service Plan CPU Percentage\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"CpuPercentage\",\n \"metricNamespace\": \"Microsoft.Web/serverfarms\",\n \"metricName\": \"CpuPercentage\",\n \"operator\": \"GreaterThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-CpuPercentage-threshold-Override_'), field('tags._amba-CpuPercentage-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#1": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_WSF_DiskQueueLength_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy App Service Plan Disk Queue Length Alert\",\n \"description\": \"Policy to audit/deploy App Service Plan Disk Queue Length Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Web Services\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Web/serverfarms\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Web/serverfarms\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"DiskQueueLength\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Web/serverfarms/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\n \"equals\": \"GreaterThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\n \"equals\": \"Medium\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": 2\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": 2\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-DiskQueueLengthAlert')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for App Service Plan Disk Queue Length\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"alertSensitivity\": \"Medium\",\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": 2,\n \"minFailingPeriodsToAlert\": 2\n },\n \"name\": \"ServiceApiResult\",\n \"metricNamespace\": \"Microsoft.Web/serverfarms\",\n \"metricName\": \"DiskQueueLength\",\n \"operator\": \"GreaterThan\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"DynamicThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#2": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_WSF_HttpQueueLength_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy App Service Plan Http Queue Length Alert\",\n \"description\": \"Policy to audit/deploy App Service Plan Http Queue Length Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"category\": \"Web Services\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"alzCloudEnvironments\": [\n \"AzureCloud\"\n ],\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Web/serverfarms\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Web/serverfarms\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"HttpQueueLength\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Web/serverfarms/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\n \"equals\": \"GreaterThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\n \"equals\": \"Medium\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\n \"equals\": 2\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\n \"equals\": 2\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-HttpQueueLengthAlert')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for App Service Plan Http Queue Length\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"alertSensitivity\": \"Medium\",\n \"failingPeriods\": {\n \"numberOfEvaluationPeriods\": 2,\n \"minFailingPeriodsToAlert\": 2\n },\n \"name\": \"ServiceApiResult\",\n \"metricNamespace\": \"Microsoft.Web/serverfarms\",\n \"metricName\": \"HttpQueueLength\",\n \"operator\": \"GreaterThan\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"DynamicThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#3": "{\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\n \"apiVersion\": \"2021-06-01\",\n \"name\": \"Deploy_WSF_MemoryPercentage_Alert\",\n \"properties\": {\n \"policyType\": \"Custom\",\n \"mode\": \"All\",\n \"displayName\": \"Deploy App Service Plan Memory Percentage Alert\",\n \"description\": \"Policy to audit/deploy App Service Plan Memory Percentage Alert\",\n \"metadata\": {\n \"version\": \"1.2.0\",\n \"Category\": \"Web Services\",\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\n \"_deployed_by_amba\": \"True\"\n },\n \"parameters\": {\n \"severity\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Severity\",\n \"description\": \"Severity of the Alert\"\n },\n \"allowedValues\": [\n \"0\",\n \"1\",\n \"2\",\n \"3\",\n \"4\"\n ],\n \"defaultValue\": \"2\"\n },\n \"windowSize\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Window Size\",\n \"description\": \"Window size for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\",\n \"PT6H\",\n \"PT12H\",\n \"P1D\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Evaluation Frequency\",\n \"description\": \"Evaluation frequency for the alert\"\n },\n \"allowedValues\": [\n \"PT1M\",\n \"PT5M\",\n \"PT15M\",\n \"PT30M\",\n \"PT1H\"\n ],\n \"defaultValue\": \"PT5M\"\n },\n \"autoMitigate\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Auto Mitigate\",\n \"description\": \"Auto Mitigate for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"enabled\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Alert State\",\n \"description\": \"Alert state for the alert\"\n },\n \"allowedValues\": [\n \"true\",\n \"false\"\n ],\n \"defaultValue\": \"true\"\n },\n \"threshold\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Threshold\",\n \"description\": \"Threshold for the alert\"\n },\n \"defaultValue\": \"85\"\n },\n \"effect\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"Effect\",\n \"description\": \"Effect of the policy\"\n },\n \"allowedValues\": [\n \"deployIfNotExists\",\n \"disabled\"\n ],\n \"defaultValue\": \"deployIfNotExists\"\n },\n \"MonitorDisableTagName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag name\",\n \"description\": \"Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": \"MonitorDisable\"\n },\n \"MonitorDisableTagValues\": {\n \"type\": \"Array\",\n \"metadata\": {\n \"displayName\": \"ALZ Monitoring disabled tag values(s)\",\n \"description\": \"Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled.\"\n },\n \"defaultValue\": [\n \"true\",\n \"Test\",\n \"Dev\",\n \"Sandbox\"\n ]\n }\n },\n \"policyRule\": {\n \"if\": {\n \"allOf\": [\n {\n \"field\": \"type\",\n \"equals\": \"Microsoft.Web/serverfarms\"\n },\n {\n \"field\": \"[[concat('tags[', parameters('MonitorDisableTagName'), ']')]\",\n \"notIn\": \"[[parameters('MonitorDisableTagValues')]\"\n }\n ]\n },\n \"then\": {\n \"effect\": \"[[parameters('effect')]\",\n \"details\": {\n \"roleDefinitionIds\": [\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\n ],\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"existenceCondition\": {\n \"allOf\": [\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\n \"equals\": \"Microsoft.Web/serverfarms\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\n \"equals\": \"MemoryPercentage\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Web/serverfarms/', field('fullName'))]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\n \"equals\": \"[[parameters('enabled')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\n \"equals\": \"[[parameters('evaluationFrequency')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\n \"equals\": \"[[parameters('windowSize')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\n \"equals\": \"[[parameters('severity')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\n \"equals\": \"[[parameters('autoMitigate')]\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\n \"equals\": \"Average\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\n \"equals\": \"GreaterThan\"\n },\n {\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\n \"equals\": \"[[if(contains(field('tags'), '_amba-MemoryPercentage-threshold-Override_'), field('tags._amba-MemoryPercentage-threshold-Override_'), parameters('threshold'))]\"\n }\n ]\n },\n \"deployment\": {\n \"properties\": {\n \"mode\": \"incremental\",\n \"template\": {\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {\n \"resourceName\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceName\",\n \"description\": \"Name of the resource\"\n }\n },\n \"resourceId\": {\n \"type\": \"String\",\n \"metadata\": {\n \"displayName\": \"resourceId\",\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\n }\n },\n \"severity\": {\n \"type\": \"String\"\n },\n \"windowSize\": {\n \"type\": \"String\"\n },\n \"evaluationFrequency\": {\n \"type\": \"String\"\n },\n \"autoMitigate\": {\n \"type\": \"String\"\n },\n \"enabled\": {\n \"type\": \"String\"\n },\n \"threshold\": {\n \"type\": \"String\"\n }\n },\n \"variables\": {},\n \"resources\": [\n {\n \"type\": \"Microsoft.Insights/metricAlerts\",\n \"apiVersion\": \"2018-03-01\",\n \"name\": \"[[concat(parameters('resourceName'), '-MemoryPercentage')]\",\n \"location\": \"global\",\n \"tags\": {\n \"_deployed_by_amba\": true\n },\n \"properties\": {\n \"description\": \"Metric Alert for App Service Plan Memory Percentage\",\n \"severity\": \"[[parameters('severity')]\",\n \"enabled\": \"[[parameters('enabled')]\",\n \"scopes\": [\n \"[[parameters('resourceId')]\"\n ],\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\n \"windowSize\": \"[[parameters('windowSize')]\",\n \"criteria\": {\n \"allOf\": [\n {\n \"name\": \"MemoryPercentage\",\n \"metricNamespace\": \"Microsoft.Web/serverfarms\",\n \"metricName\": \"MemoryPercentage\",\n \"operator\": \"GreaterThan\",\n \"threshold\": \"[[parameters('threshold')]\",\n \"timeAggregation\": \"Average\",\n \"criterionType\": \"StaticThresholdCriterion\"\n }\n ],\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\n },\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\n \"parameters\": {\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[parameters('threshold')]\"\n }\n }\n }\n }\n ]\n },\n \"parameters\": {\n \"resourceName\": {\n \"value\": \"[[field('name')]\"\n },\n \"resourceId\": {\n \"value\": \"[[field('id')]\"\n },\n \"severity\": {\n \"value\": \"[[parameters('severity')]\"\n },\n \"windowSize\": {\n \"value\": \"[[parameters('windowSize')]\"\n },\n \"evaluationFrequency\": {\n \"value\": \"[[parameters('evaluationFrequency')]\"\n },\n \"autoMitigate\": {\n \"value\": \"[[parameters('autoMitigate')]\"\n },\n \"enabled\": {\n \"value\": \"[[parameters('enabled')]\"\n },\n \"threshold\": {\n \"value\": \"[[if(contains(field('tags'), '_amba-MemoryPercentage-threshold-Override_'), field('tags._amba-MemoryPercentage-threshold-Override_'), parameters('threshold'))]\"\n }\n }\n }\n }\n }\n }\n }\n }\n}\n", + "$fxv#4": { + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "name": "Alerting-Web", + "properties": { + "displayName": "Deploy Azure Monitor Baseline Alerts for Web", + "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Web Services such as App Services.", + "metadata": { + "version": "1.0.0", + "category": "Monitoring", + "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", + "alzCloudEnvironments": [ + "AzureCloud" + ], + "_deployed_by_amba": true + }, + "parameters": { + "ALZMonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": "MonitorDisable" + }, + "ALZMonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] + }, + "WSFCPUPercentageAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "WSF CPU Percentage Alert Severity", + "description": "Severity of the alert" + } + }, + "WSFCPUPercentageWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "WSF CPU Percentage Window Size", + "description": "Window size for the alert" + } + }, + "WSFCPUPercentageEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "WSF CPU Percentage Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "WSFCPUPercentagePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "WSF CPU Percentage Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "WSFCPUPercentageAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "WSF CPU Percentage Alert State", + "description": "Alert state for the alert" + } + }, + "WSFCPUPercentageThreshold": { + "type": "string", + "defaultValue": "90", + "metadata": { + "displayName": "WSF CPU Percentage Threshold", + "description": "Threshold for the alert" + } + }, + "WSFMemoryPercentageAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "WSF Memory Percentage Alert Severity", + "description": "Severity of the alert" + } + }, + "WSFMemoryPercentageWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "WSF Memory Percentage Window Size", + "description": "Window size for the alert" + } + }, + "WSFMemoryPercentageEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "WSF Memory Percentage Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "WSFMemoryPercentagePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "WSF Memory Percentage Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "WSFMemoryPercentageAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "WSF Memory Percentage Alert State", + "description": "Alert state for the alert" + } + }, + "WSFMemoryPercentageThreshold": { + "type": "string", + "defaultValue": "85", + "metadata": { + "displayName": "WSF Memory Percentage Threshold", + "description": "Threshold for the alert" + } + }, + "WSFDiskQueueLengthAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "WSF Disk Queue Lenght Alert Severity", + "description": "Severity of the alert" + } + }, + "WSFDiskQueueLengthWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "WSF Disk Queue Lenght Window Size", + "description": "Window size for the alert" + } + }, + "WSFDiskQueueLengthEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "WSF Disk Queue Lenght Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "WSFDiskQueueLengthPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "WSF Disk Queue Lenght Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "WSFDiskQueueLengthAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "WSF Disk Queue Lenght Alert State", + "description": "Alert state for the alert" + } + }, + "WSFHttpQueueLengthAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "WSF HTTP Queue Lenght Alert Severity", + "description": "Severity of the alert" + } + }, + "WSFHttpQueueLengthWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "WSF HTTP Queue Lenght Window Size", + "description": "Window size for the alert" + } + }, + "WSFHttpQueueLengthEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "WSF HTTP Queue Lenght Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "WSFHttpQueueLengthPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "WSF HTTP Queue Lenght Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "WSFHttpQueueLengthAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "WSF HTTP Queue Lenght Alert State", + "description": "Alert state for the alert" + } + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "ALZ_WSFCPUPercentage", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_WSF_CPUPercentage_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('WSFCPUPercentageAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('WSFCPUPercentageWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('WSFCPUPercentageEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('WSFCPUPercentagePolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('WSFCPUPercentageAlertState')]" + }, + "threshold": { + "value": "[[[parameters('WSFCPUPercentageThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_WSFMemoryPercentage", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_WSF_MemoryPercentage_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('WSFMemoryPercentageAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('WSFMemoryPercentageWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('WSFMemoryPercentageEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('WSFMemoryPercentagePolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('WSFMemoryPercentageAlertState')]" + }, + "threshold": { + "value": "[[[parameters('WSFMemoryPercentageThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_WSFDiskQueueLength", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_WSF_DiskQueueLength_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('WSFDiskQueueLengthAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('WSFDiskQueueLengthWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('WSFDiskQueueLengthEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('WSFDiskQueueLengthPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('WSFDiskQueueLengthAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_WSFHttpQueueLength", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_WSF_HttpQueueLength_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('WSFHttpQueueLengthAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('WSFHttpQueueLengthWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('WSFHttpQueueLengthEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('WSFHttpQueueLengthPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('WSFHttpQueueLengthAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + } + ], + "policyType": "Custom", + "policyDefinitionGroups": null + } + }, + "cloudEnv": "[environment().name]", + "defaultDeploymentLocationByCloudType": { + "AzureCloud": "northeurope", + "AzureChinaCloud": "chinaeast2", + "AzureUSGovernment": "usgovvirginia" + }, + "templateVars": { + "scope": "/providers/Microsoft.Management/managementGroups/contoso", + "defaultDeploymentLocation": "\"location\": \"northeurope\"", + "localizedDeploymentLocation": "[format('\"location\": \"{0}\"', variables('defaultDeploymentLocationByCloudType')[variables('cloudEnv')])]" + }, + "targetDeploymentLocationByCloudType": { + "AzureCloud": "[coalesce(parameters('location'), 'northeurope')]", + "AzureChinaCloud": "[coalesce(parameters('location'), 'chinaeast2')]", + "AzureUSGovernment": "[coalesce(parameters('location'), 'usgovvirginia')]" + }, + "deploymentLocation": "[format('\"location\": \"{0}\"', variables('targetDeploymentLocationByCloudType')[variables('cloudEnv')])]", + "loadPolicyDefinitions": { + "All": [ + "[variables('$fxv#0')]", + "[variables('$fxv#1')]", + "[variables('$fxv#2')]", + "[variables('$fxv#3')]" + ], + "AzureCloud": [], + "AzureChinaCloud": [], + "AzureUSGovernment": [] + }, + "loadPolicySetDefinitions": { + "All": [ + "[string(variables('$fxv#4'))]" + ], + "AzureCloud": [], + "AzureChinaCloud": [], + "AzureUSGovernment": [] + }, + "policyDefinitionsByCloudType": { + "All": "[variables('policyDefinitionsAll')]", + "AzureCloud": "[variables('policyDefinitionsAzureCloud')]", + "AzureChinaCloud": "[variables('policyDefinitionsAzureChinaCloud')]", + "AzureUSGovernment": "[variables('policyDefinitionsAzureUSGovernment')]" + }, + "policySetDefinitionsByCloudType": { + "All": "[variables('policySetDefinitionsAll')]", + "AzureCloud": "[variables('policySetDefinitionsAzureCloud')]", + "AzureChinaCloud": "[variables('policySetDefinitionsAzureChinaCloud')]", + "AzureUSGovernment": "[variables('policySetDefinitionsAzureUSGovernment')]" + }, + "policyDefinitions": "[concat(variables('policyDefinitionsByCloudType').All, variables('policyDefinitionsByCloudType')[variables('cloudEnv')])]", + "policySetDefinitions": "[concat(variables('policySetDefinitionsByCloudType').All, variables('policySetDefinitionsByCloudType')[variables('cloudEnv')])]" + }, + "resources": [ + { + "copy": { + "name": "PolicyDefinitions", + "count": "[length(variables('policyDefinitions'))]" + }, + "type": "Microsoft.Authorization/policyDefinitions", + "apiVersion": "2020-09-01", + "name": "[variables('policyDefinitions')[copyIndex()].name]", + "properties": { + "description": "[variables('policyDefinitions')[copyIndex()].properties.description]", + "displayName": "[variables('policyDefinitions')[copyIndex()].properties.displayName]", + "metadata": "[variables('policyDefinitions')[copyIndex()].properties.metadata]", + "mode": "[variables('policyDefinitions')[copyIndex()].properties.mode]", + "parameters": "[variables('policyDefinitions')[copyIndex()].properties.parameters]", + "policyType": "[variables('policyDefinitions')[copyIndex()].properties.policyType]", + "policyRule": "[variables('policyDefinitions')[copyIndex()].properties.policyRule]" + } + }, + { + "copy": { + "name": "PolicySetDefinitions", + "count": "[length(variables('policySetDefinitions'))]" + }, + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2020-09-01", + "name": "[variables('policySetDefinitions')[copyIndex()].name]", + "properties": { + "description": "[variables('policySetDefinitions')[copyIndex()].properties.description]", + "displayName": "[variables('policySetDefinitions')[copyIndex()].properties.displayName]", + "metadata": "[variables('policySetDefinitions')[copyIndex()].properties.metadata]", + "parameters": "[variables('policySetDefinitions')[copyIndex()].properties.parameters]", + "policyType": "[variables('policySetDefinitions')[copyIndex()].properties.policyType]", + "policyDefinitions": "[variables('policySetDefinitions')[copyIndex()].properties.policyDefinitions]", + "policyDefinitionGroups": "[variables('policySetDefinitions')[copyIndex()].properties.policyDefinitionGroups]" + }, + "dependsOn": [ + "PolicyDefinitions" + ] + } + ], + "outputs": { + "policyDefinitionNames": { + "type": "array", + "copy": { + "count": "[length(variables('policyDefinitions'))]", + "input": "[variables('policyDefinitions')[copyIndex()].name]" + } + }, + "policySetDefinitionNames": { + "type": "array", + "copy": { + "count": "[length(variables('policySetDefinitions'))]", + "input": "[variables('policySetDefinitions')[copyIndex()].name]" + } + } + } +} \ No newline at end of file diff --git a/patterns/alz/policyDefinitions/policies.json b/patterns/alz/policyDefinitions/policies.json deleted file mode 100644 index 743b57b74..000000000 --- a/patterns/alz/policyDefinitions/policies.json +++ /dev/null @@ -1,14641 +0,0 @@ -{ - "$schema": "https://schema.management.azure.com/schemas/2019-08-01/managementGroupDeploymentTemplate.json#", - "contentVersion": "1.0.0.0", - "metadata": { - "_generator": { - "name": "bicep", - "version": "0.18.4.5664", - "templateHash": "16331750371302617517" - } - }, - "parameters": { - "topLevelManagementGroupPrefix": { - "type": "string", - "defaultValue": "alz", - "metadata": { - "description": "Provide a prefix (unique at tenant-scope) for the Management Group hierarchy and other resources created as part of an Azure landing zone. DEFAULT VALUE = \"alz\"", - "message": "The JSON version of this file is programatically generated from Bicep. PLEASE DO NOT UPDATE MANUALLY!!" - } - }, - "location": { - "type": "string", - "defaultValue": "[deployment().location]", - "metadata": { - "description": "Optionally set the deployment location for policies with Deploy If Not Exists effect. DEFAULT VALUE = \"deployment().location\"" - } - }, - "scope": { - "type": "string", - "defaultValue": "[tenantResourceId('Microsoft.Management/managementGroups', parameters('topLevelManagementGroupPrefix'))]", - "metadata": { - "description": "Optionally set the scope for custom Policy Definitions used in Policy Set Definitions (Initiatives). Must be one of '/', '/subscriptions/id' or '/providers/Microsoft.Management/managementGroups/id'. DEFAULT VALUE = '/providers/Microsoft.Management/managementGroups/${topLevelManagementGroupPrefix}'" - } - } - }, - "variables": { - "copy": [ - { - "name": "processPolicyDefinitionsAll", - "count": "[length(variables('loadPolicyDefinitions').All)]", - "input": "[replace(replace(variables('loadPolicyDefinitions').All[copyIndex('processPolicyDefinitionsAll')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" - }, - { - "name": "processPolicyDefinitionsAzureCloud", - "count": "[length(variables('loadPolicyDefinitions').AzureCloud)]", - "input": "[replace(replace(variables('loadPolicyDefinitions').AzureCloud[copyIndex('processPolicyDefinitionsAzureCloud')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" - }, - { - "name": "processPolicyDefinitionsAzureChinaCloud", - "count": "[length(variables('loadPolicyDefinitions').AzureChinaCloud)]", - "input": "[replace(replace(variables('loadPolicyDefinitions').AzureChinaCloud[copyIndex('processPolicyDefinitionsAzureChinaCloud')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" - }, - { - "name": "processPolicyDefinitionsAzureUSGovernment", - "count": "[length(variables('loadPolicyDefinitions').AzureUSGovernment)]", - "input": "[replace(replace(variables('loadPolicyDefinitions').AzureUSGovernment[copyIndex('processPolicyDefinitionsAzureUSGovernment')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" - }, - { - "name": "processPolicySetDefinitionsAll", - "count": "[length(variables('loadPolicySetDefinitions').All)]", - "input": "[replace(variables('loadPolicySetDefinitions').All[copyIndex('processPolicySetDefinitionsAll')], variables('templateVars').scope, parameters('scope'))]" - }, - { - "name": "processPolicySetDefinitionsAzureCloud", - "count": "[length(variables('loadPolicySetDefinitions').AzureCloud)]", - "input": "[replace(variables('loadPolicySetDefinitions').AzureCloud[copyIndex('processPolicySetDefinitionsAzureCloud')], variables('templateVars').scope, parameters('scope'))]" - }, - { - "name": "processPolicySetDefinitionsAzureChinaCloud", - "count": "[length(variables('loadPolicySetDefinitions').AzureChinaCloud)]", - "input": "[replace(variables('loadPolicySetDefinitions').AzureChinaCloud[copyIndex('processPolicySetDefinitionsAzureChinaCloud')], variables('templateVars').scope, parameters('scope'))]" - }, - { - "name": "processPolicySetDefinitionsAzureUSGovernment", - "count": "[length(variables('loadPolicySetDefinitions').AzureUSGovernment)]", - "input": "[replace(variables('loadPolicySetDefinitions').AzureUSGovernment[copyIndex('processPolicySetDefinitionsAzureUSGovernment')], variables('templateVars').scope, parameters('scope'))]" - }, - { - "name": "policyDefinitionsAll", - "count": "[length(variables('processPolicyDefinitionsAll'))]", - "input": "[json(variables('processPolicyDefinitionsAll')[copyIndex('policyDefinitionsAll')])]" - }, - { - "name": "policyDefinitionsAzureCloud", - "count": "[length(variables('processPolicyDefinitionsAzureCloud'))]", - "input": "[json(variables('processPolicyDefinitionsAzureCloud')[copyIndex('policyDefinitionsAzureCloud')])]" - }, - { - "name": "policyDefinitionsAzureChinaCloud", - "count": "[length(variables('processPolicyDefinitionsAzureChinaCloud'))]", - "input": "[json(variables('processPolicyDefinitionsAzureChinaCloud')[copyIndex('policyDefinitionsAzureChinaCloud')])]" - }, - { - "name": "policyDefinitionsAzureUSGovernment", - "count": "[length(variables('processPolicyDefinitionsAzureUSGovernment'))]", - "input": "[json(variables('processPolicyDefinitionsAzureUSGovernment')[copyIndex('policyDefinitionsAzureUSGovernment')])]" - }, - { - "name": "policySetDefinitionsAll", - "count": "[length(variables('processPolicySetDefinitionsAll'))]", - "input": "[json(variables('processPolicySetDefinitionsAll')[copyIndex('policySetDefinitionsAll')])]" - }, - { - "name": "policySetDefinitionsAzureCloud", - "count": "[length(variables('processPolicySetDefinitionsAzureCloud'))]", - "input": "[json(variables('processPolicySetDefinitionsAzureCloud')[copyIndex('policySetDefinitionsAzureCloud')])]" - }, - { - "name": "policySetDefinitionsAzureChinaCloud", - "count": "[length(variables('processPolicySetDefinitionsAzureChinaCloud'))]", - "input": "[json(variables('processPolicySetDefinitionsAzureChinaCloud')[copyIndex('policySetDefinitionsAzureChinaCloud')])]" - }, - { - "name": "policySetDefinitionsAzureUSGovernment", - "count": "[length(variables('processPolicySetDefinitionsAzureUSGovernment'))]", - "input": "[json(variables('processPolicySetDefinitionsAzureUSGovernment')[copyIndex('policySetDefinitionsAzureUSGovernment')])]" - } - ], - "$fxv#0": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_activitylog_Firewall_Delete\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Activity Log Azure FireWall Delete Alert\",\r\n \"description\": \"Policy to Deploy Activity Log Azure Firewall Delete Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.0.2\",\r\n \"category\": \"Network\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"environment\": \"test\",\r\n \"_deployed_by_amba\": true\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring on resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/azureFirewalls\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"deployIfNotExists\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/activityLogAlerts\",\r\n \"name\": \"ActivityAzureFirewallDelete\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"count\": {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*]\",\r\n \"where\": {\r\n \"anyOf\": [\r\n {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].field\",\r\n \"equals\": \"category\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].equals\",\r\n \"equals\": \"Administrative\"\r\n }\r\n ]\r\n },\r\n {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].field\",\r\n \"equals\": \"operationName\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].equals\",\r\n \"equals\": \"Microsoft.Network/azureFirewalls/delete\"\r\n }\r\n ]\r\n }\r\n ]\r\n }\r\n },\r\n \"equals\": 2\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2020-10-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"ActivityAzureFirewallDelete\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"microsoft.insights/activityLogAlerts\",\r\n \"apiVersion\": \"2020-10-01\",\r\n \"name\": \"ActivityAzureFirewallDelete\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Activity Log Firewall Delete\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().id]\"\r\n ],\r\n \"condition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"category\",\r\n \"equals\": \"Administrative\"\r\n },\r\n {\r\n \"field\": \"operationName\",\r\n \"equals\": \"Microsoft.Network/azurefirewalls/delete\"\r\n },\r\n {\r\n \"field\": \"status\",\r\n \"containsAny\": [\r\n \"succeeded\"\r\n ]\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#1": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_activitylog_NSG_Delete\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Activity Log NSG Delete Alert\",\r\n \"description\": \"Policy to Deploy Activity Log NSG Delete Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.0.2\",\r\n \"category\": \"Network\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"environment\": \"test\",\r\n \"_deployed_by_amba\": true\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring on resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/networkSecurityGroups\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"deployIfNotExists\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/activityLogAlerts\",\r\n \"name\": \"ActivityNSGDelete\",\r\n \"existenceScope\": \"resourcegroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"count\": {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*]\",\r\n \"where\": {\r\n \"anyOf\": [\r\n {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].field\",\r\n \"equals\": \"category\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].equals\",\r\n \"equals\": \"Administrative\"\r\n }\r\n ]\r\n },\r\n {\r\n \"allOf\": [\r\n {\r\n \"field\": \"microsoft.insights/activityLogAlerts/condition.allOf[*].field\",\r\n \"equals\": \"operationName\"\r\n },\r\n {\r\n \"field\": \"microsoft.insights/activityLogAlerts/condition.allOf[*].equals\",\r\n \"equals\": \"Microsoft.Network/networkSecurityGroups/delete\"\r\n }\r\n ]\r\n }\r\n ]\r\n }\r\n },\r\n \"equals\": 2\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"ActivityNSGDelete\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"microsoft.insights/activityLogAlerts\",\r\n \"apiVersion\": \"2020-10-01\",\r\n \"name\": \"ActivityNSGDelete\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Activity Log NSG Delete\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().id]\"\r\n ],\r\n \"condition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"category\",\r\n \"equals\": \"Administrative\"\r\n },\r\n {\r\n \"field\": \"operationName\",\r\n \"equals\": \"Microsoft.Network/networkSecurityGroups/delete\"\r\n },\r\n {\r\n \"field\": \"status\",\r\n \"containsAny\": [\r\n \"succeeded\"\r\n ]\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#10": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_ERGw_ExpressRouteBitsIn_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy ERG ExpressRoute Bits In Alert\",\r\n \"description\": \"Policy to audit/deploy ER Gateway Connection BitsInPerSecond Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.0\",\r\n \"category\": \"Network\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"0\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"disabled\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/expressroutegateways\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/expressroutegateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"ERGatewayConnectionBitsInPerSecond\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/expressroutegateways/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"LessThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-GatewayERBitsInAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for ER Gateway Connection BitsInPerSecond\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"ERGatewayConnectionBitsInPerSecond\",\r\n \"metricNamespace\": \"Microsoft.Network/expressroutegateways\",\r\n \"metricName\": \"ERGatewayConnectionBitsInPerSecond\",\r\n \"operator\": \"LessThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#100": "{\r\n\t\"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_Disconnected_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM Disconnected Alert\",\r\n \"description\": \"Policy to Deploy Hybrid VM Disconnected Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.0.0\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"Project\": \"amba-monitoring\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"eastus\"\r\n },\r\n \"userAssignedManagedIdentityName\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"id-AMBA-ARG-Reader-001\",\r\n \"metadata\": {\r\n \"description\": \"The name of the user assigned managed identity to be created for monitoring purpose.\",\r\n \"displayName\": \"Name of the user assigned managed identity to be created.\"\r\n }\r\n },\r\n \"managementSubscriptionId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The subscription ID of the management subscription where the user assigned managed identity will be created.\"\r\n }\r\n },\r\n \"BYOUserAssignedManagedIdentityResourceId\": {\r\n \"type\": \"string\",\r\n \"defaultValue\": \"\",\r\n \"metadata\": {\r\n \"description\": \"The resource Id of the user assigned managed identity provided by the customer.\",\r\n \"displayName\": \"Customer defined User Assigned managed Identity resource Id.\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"1\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"Equals\",\r\n \"GreaterThan\",\r\n \"GreaterThanOrEqual\",\r\n \"LessThan\",\r\n \"LessThanOrEqual\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Average\",\r\n \"Maximum\",\r\n \"Minimum\",\r\n \"Total\",\r\n \"Count\"\r\n ],\r\n \"defaultValue\": \"Count\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"P1D\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"P1D\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"0\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"microsoft.hybridcompute/machines\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMDisconnected')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold\",\r\n \"equals\": 0\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"[[format('arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | where tostring(properties.status) == \\\"Disconnected\\\" | extend lastContactedDate = todatetime(properties.lastStatusChange) | where lastContactedDate <= ago({0}d) | extend status = tostring(properties.status) | project id, Computer=name, status, lastContactedDate', parameters('threshold'))]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"userAssignedManagedIdentityName\": {\r\n \"type\": \"string\"\r\n },\r\n \"managementSubscriptionId\": {\r\n \"type\": \"string\"\r\n },\r\n \"BYOUserAssignedManagedIdentityResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {\r\n \"uamiResourceId\": \"[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), resourceId(parameters('managementSubscriptionId'), parameters('alertResourceGroupName'), 'Microsoft.ManagedIdentity/userAssignedIdentities', parameters('userAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]\"\r\n },\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"HybridVMDisconnectedAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\"userAssignedManagedIdentityName\": {\r\n \"type\": \"string\"\r\n },\r\n \"managementSubscriptionId\": {\r\n \"type\": \"string\"\r\n },\r\n \"BYOUserAssignedManagedIdentityResourceId\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-HybridVMDisconnected')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"identity\": {\r\n \"type\": \"UserAssigned\",\r\n \"userAssignedIdentities\": {\r\n \"[[variables('uamiResourceId')]\": {}\r\n }\r\n },\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMDisconnected')]\",\r\n \"description\": \"Hybrid VM in disconnected state. Not being connected, prevents extensions to be correctly managed from the portal and Azure policies to be correctly applied. Ensure that both server the specific service (Azure Hybrid Instance Metadata Service on Windows or azcmagent on Linux) are running.\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.HybridCompute/machines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"[[format('arg(\\\"\\\").resources | where type == \\\"microsoft.hybridcompute/machines\\\" | where tostring(properties.status) == \\\"Disconnected\\\" | extend lastContactedDate = todatetime(properties.lastStatusChange) | where lastContactedDate <= ago({0}d) | extend status = tostring(properties.status) | project id, Computer=name, status, lastContactedDate', parameters('threshold'))]\",\r\n \"resourceIdColumn\": \"id\",\r\n \"threshold\": 0,\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"false\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"userAssignedManagedIdentityName\": {\r\n \"value\": \"[[parameters('userAssignedManagedIdentityName')]\"\r\n },\r\n \"managementSubscriptionId\": {\r\n \"value\": \"[[parameters('managementSubscriptionId')]\"\r\n },\r\n \"BYOUserAssignedManagedIdentityResourceId\": {\r\n \"value\": \"[[parameters('BYOUserAssignedManagedIdentityResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"userAssignedManagedIdentityName\": {\r\n \"value\": \"[[parameters('userAssignedManagedIdentityName')]\"\r\n },\r\n \"managementSubscriptionId\": {\r\n \"value\": \"[[parameters('managementSubscriptionId')]\"\r\n },\r\n \"BYOUserAssignedManagedIdentityResourceId\": {\r\n \"value\": \"[[parameters('BYOUserAssignedManagedIdentityResourceId')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"userAssignedManagedIdentityName\": {\r\n \"value\": \"[[parameters('userAssignedManagedIdentityName')]\"\r\n },\r\n \"managementSubscriptionId\": {\r\n \"value\": \"[[parameters('managementSubscriptionId')]\"\r\n },\r\n \"BYOUserAssignedManagedIdentityResourceId\": {\r\n \"value\": \"[[parameters('BYOUserAssignedManagedIdentityResourceId')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#101": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_AA_TotalJob_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Automation Account TotalJob Alert\",\r\n \"description\": \"Policy to audit/deploy Automation Account TotalJob Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.0\",\r\n \"category\": \"Automation\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT1M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"0\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring on resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Automation/automationAccounts\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Automation/automationAccounts\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"TotalJob\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Automation/automationAccounts/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-TotalJob')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for Automation Account TotalJob Alert\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"TotalJob\",\r\n \"metricNamespace\": \"Microsoft.Automation/automationAccounts\",\r\n \"metricName\": \"TotalJob\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Status\",\r\n \"operator\": \"Exclude\",\r\n \"values\": [\r\n \"Completed\"\r\n ]\r\n }\r\n ],\r\n \"operator\": \"GreaterThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#102": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_activitylog_LAWorkspace_Delete\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Activity Log LA Workspace Delete Alert\",\r\n \"description\": \"Policy to Deploy Activity Log LA Workspace Delete Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.0.3\",\r\n \"category\": \"Monitoring\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"_deployed_by_amba\": true\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring on resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.OperationalInsights/workspaces\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"deployIfNotExists\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/activityLogAlerts\",\r\n \"name\": \"ActivityLAWorkspaceDelete\",\r\n \"existenceScope\": \"resourcegroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"count\": {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*]\",\r\n \"where\": {\r\n \"anyOf\": [\r\n {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].field\",\r\n \"equals\": \"category\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].equals\",\r\n \"equals\": \"Administrative\"\r\n }\r\n ]\r\n },\r\n {\r\n \"allOf\": [\r\n {\r\n \"field\": \"microsoft.insights/activityLogAlerts/condition.allOf[*].field\",\r\n \"equals\": \"operationName\"\r\n },\r\n {\r\n \"field\": \"microsoft.insights/activityLogAlerts/condition.allOf[*].equals\",\r\n \"equals\": \"Microsoft.OperationalInsights/workspaces/delete\"\r\n }\r\n ]\r\n }\r\n ]\r\n }\r\n },\r\n \"equals\": 2\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"ActivityLAWorkspaceDelete\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"microsoft.insights/activityLogAlerts\",\r\n \"apiVersion\": \"2020-10-01\",\r\n \"name\": \"ActivityLAWorkspaceDelete\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Activity Log LA Workspace Delete\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().id]\"\r\n ],\r\n \"condition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"category\",\r\n \"equals\": \"Administrative\"\r\n },\r\n {\r\n \"field\": \"operationName\",\r\n \"equals\": \"Microsoft.OperationalInsights/workspaces/delete\"\r\n },\r\n {\r\n \"field\": \"status\",\r\n \"containsAny\": [\r\n \"succeeded\"\r\n ]\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#103": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_activitylog_LAWorkspace_KeyRegen\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Activity Log LA Workspace Regenerate Key Alert\",\r\n \"description\": \"Policy to Deploy Activity Log LA Workspace Regenerate Key Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.0.2\",\r\n \"category\": \"Monitoring\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"environment\": \"test\",\r\n \"_deployed_by_amba\": true\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring on resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.OperationalInsights/workspaces\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"deployIfNotExists\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/activityLogAlerts\",\r\n \"name\": \"ActivityLAWorkspaceRegenKey\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"count\": {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*]\",\r\n \"where\": {\r\n \"anyOf\": [\r\n {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].field\",\r\n \"equals\": \"category\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].equals\",\r\n \"equals\": \"Administrative\"\r\n }\r\n ]\r\n },\r\n {\r\n \"allOf\": [\r\n {\r\n \"field\": \"microsoft.insights/activityLogAlerts/condition.allOf[*].field\",\r\n \"equals\": \"operationName\"\r\n },\r\n {\r\n \"field\": \"microsoft.insights/activityLogAlerts/condition.allOf[*].equals\",\r\n \"equals\": \"Microsoft.OperationalInsights/workspaces/regeneratesharedkey/action\"\r\n }\r\n ]\r\n }\r\n ]\r\n }\r\n },\r\n \"equals\": 2\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"ActivityLAWorkspaceRegenKey\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"microsoft.insights/activityLogAlerts\",\r\n \"apiVersion\": \"2020-10-01\",\r\n \"name\": \"ActivityLAWorkspaceRegenKey\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Activity Log LA Workspace Regenerate Key\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().id]\"\r\n ],\r\n \"condition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"category\",\r\n \"equals\": \"Administrative\"\r\n },\r\n {\r\n \"field\": \"operationName\",\r\n \"equals\": \"Microsoft.OperationalInsights/workspaces/regeneratesharedkey/action\"\r\n },\r\n {\r\n \"field\": \"status\",\r\n \"containsAny\": [\r\n \"succeeded\"\r\n ]\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#104": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_StorageAccount_Availability_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy SA Availability Alert\",\r\n \"description\": \"Policy to audit/deploy SA Availability Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.0\",\r\n \"category\": \"Storage\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"1\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"90\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Monitoring disabled\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Storage/storageAccounts\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Storage/storageAccounts\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"Availability\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Storage/storageAccounts/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"LessThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-AvailabilityAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for Storage Account Availability\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"Availability\",\r\n \"metricNamespace\": \"Microsoft.Storage/storageAccounts\",\r\n \"metricName\": \"Availability\",\r\n \"operator\": \"LessThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#105": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_activitylog_StorageAccount_Delete\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Activity Log Storage Account Delete Alert\",\r\n \"description\": \"Policy to Deploy Activity Log Storage Account Delete Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.0\",\r\n \"category\": \"Monitoring\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"_deployed_by_amba\": true\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Monitoring disabled\",\r\n \"description\": \"Tag name to disable monitoring on resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Storage/storageAccounts\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/activityLogAlerts\",\r\n \"name\": \"Activity Log Storage Account Delete\",\r\n \"existenceScope\": \"resourcegroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"count\": {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*]\",\r\n \"where\": {\r\n \"anyOf\": [\r\n {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].field\",\r\n \"equals\": \"category\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].equals\",\r\n \"equals\": \"Administrative\"\r\n }\r\n ]\r\n },\r\n {\r\n \"allOf\": [\r\n {\r\n \"field\": \"microsoft.insights/activityLogAlerts/condition.allOf[*].field\",\r\n \"equals\": \"operationName\"\r\n },\r\n {\r\n \"field\": \"microsoft.insights/activityLogAlerts/condition.allOf[*].equals\",\r\n \"equals\": \"Microsoft.Storage/storageAccounts/delete\"\r\n }\r\n ]\r\n }\r\n ]\r\n }\r\n },\r\n \"equals\": 2\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"ActivitySADelete\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"microsoft.insights/activityLogAlerts\",\r\n \"apiVersion\": \"2020-10-01\",\r\n \"name\": \"Activity Log Storage Account Delete\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Activity Log Storage Account Delete\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().id]\"\r\n ],\r\n \"condition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"category\",\r\n \"equals\": \"Administrative\"\r\n },\r\n {\r\n \"field\": \"operationName\",\r\n \"equals\": \"Microsoft.Storage/storageAccounts/delete\"\r\n },\r\n {\r\n \"field\": \"status\",\r\n \"containsAny\": [\r\n \"succeeded\"\r\n ]\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#106": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_RecoveryVault_BackupHealthMonitor_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy RV Backup Health Monitoring Alerts\",\r\n \"description\": \"Policy to audit/update Recovery Vault Backup Health Alerting to Azure monitor alerts\",\r\n \"metadata\": {\r\n \"version\": \"1.0.0\",\r\n \"category\": \"Site Recovery\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"modify\",\r\n \"audit\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"modify\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.RecoveryServices/Vaults\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n },\r\n {\r\n \"field\": \"Microsoft.RecoveryServices/vaults/monitoringSettings.azureMonitorAlertSettings.alertsForAllJobFailures\",\r\n \"notEquals\": \"Enabled\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"conflictEffect\": \"audit\",\r\n \"operations\": [\r\n {\r\n \"operation\": \"addOrReplace\",\r\n \"field\": \"Microsoft.RecoveryServices/vaults/monitoringSettings.classicAlertSettings.alertsForCriticalOperations\",\r\n \"value\": \"Disabled\"\r\n },\r\n {\r\n \"operation\": \"addOrReplace\",\r\n \"field\": \"Microsoft.RecoveryServices/vaults/monitoringSettings.azureMonitorAlertSettings.alertsForAllJobFailures\",\r\n \"value\": \"Enabled\"\r\n }\r\n ]\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#107": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_AlertProcessing_Rule\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy AMBA Notification Assets\",\r\n \"description\": \"Policy to deploy Action Group and Alert Processing Rule for all AMBA alerts\",\r\n \"metadata\": {\r\n \"version\": \"1.2.0\",\r\n \"category\": \"Monitoring\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"ALZMonitorResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"ALZMonitorResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"_deployed_by_amba\": true\r\n }\r\n },\r\n \"ALZMonitorResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"ALZMonitorActionGroupEmail\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Action Group Email Addresses\",\r\n \"description\": \"Email addresses to send alerts to\"\r\n },\r\n \"defaultValue\": \"\"\r\n },\r\n \"ALZLogicappResourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Logic App Resource Id\",\r\n \"description\": \"Logic App Resource Id for Action Group to send alerts to\"\r\n },\r\n \"defaultValue\": \"\"\r\n },\r\n \"ALZLogicappCallbackUrl\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Logic App Callback URL\",\r\n \"description\": \"Callback URL that triggers the Logic App\"\r\n },\r\n \"defaultValue\": \"\"\r\n },\r\n \"ALZArmRoleId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Arm Role Id\",\r\n \"description\": \"Arm Built-in Role Id for action group to send alerts to a subscription level, will only send to individual members of role\"\r\n },\r\n \"defaultValue\": \"\"\r\n },\r\n \"ALZEventHubResourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Event Hub resource id\",\r\n \"description\": \"Event Hub resource id for action group to send alerts to\"\r\n },\r\n \"defaultValue\": \"\"\r\n },\r\n \"ALZWebhookServiceUri\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Webhook Service Uri\",\r\n \"description\": \"Indicates the service uri of the webhook to send alerts to\"\r\n },\r\n \"defaultValue\": \"\"\r\n },\r\n \"ALZFunctionResourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Function Resource Id\",\r\n \"description\": \"Function Resource Id for Action Group to send alerts to\"\r\n },\r\n \"defaultValue\": \"\"\r\n },\r\n \"ALZFunctionTriggerUrl\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Function Trigger URL\",\r\n \"description\": \"URL that triggers the Function\"\r\n },\r\n \"defaultValue\": \"\"\r\n },\r\n \"BYOActionGroup\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Customer defined Action Group Resource ID\",\r\n \"description\": \"The Resource ID of an existing Action Group already deployed by the customer in his environment\"\r\n },\r\n \"defaultValue\": \"\"\r\n },\r\n \"BYOAlertProcessingRule\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Customer defined Alert Processing Rule Resource ID\",\r\n \"description\": \"The Resource ID of an existing Alert Processing Rule already deployed by the customer in his environment\"\r\n },\r\n \"defaultValue\": \"\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Monitoring disabled\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Resources/subscriptions\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n },\r\n {\r\n \"value\": \"[[empty(parameters('BYOAlertProcessingRule'))]\",\r\n \"equals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"deployIfNotExists\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.AlertsManagement/actionRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('ALZMonitorResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.AlertsManagement/actionRules/description\",\r\n \"equals\": \"AMBA Notification Assets - Alert Processing Rule for Subscription\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"ALZMonitorResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"ALZMonitorResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"ALZMonitorResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"ALZMonitorActionGroupEmail\": {\r\n \"type\": \"string\"\r\n },\r\n \"ALZLogicappResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"ALZLogicappCallbackUrl\": {\r\n \"type\": \"String\"\r\n },\r\n \"ALZArmRoleId\": {\r\n \"type\": \"string\"\r\n },\r\n \"ALZEventHubResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"ALZWebhookServiceUri\": {\r\n \"type\": \"string\"\r\n },\r\n \"ALZFunctionResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"ALZFunctionTriggerUrl\": {\r\n \"type\": \"String\"\r\n },\r\n \"BYOActionGroup\": {\r\n \"type\": \"String\"\r\n },\r\n \"BYOAlertProcessingRule\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {\r\n \"varBYOAGs\": \"[[split(parameters('BYOActionGroup'), ',')]\",\r\n \"varBYOAlertProcessingRule\": \"[[if(empty(parameters('BYOAlertProcessingRule')), null(), trim(parameters('BYOAlertProcessingRule')))]\",\r\n \"varALZMonitorActionGroupEmail\": \"[[array(split(parameters('ALZMonitorActionGroupEmail'),','))]\",\r\n \"varALZArmRoleId\": \"[[array(split(parameters('ALZArmRoleId'),','))]\",\r\n \"varALZEventHubResourceId\": \"[[array(split(parameters('ALZEventHubResourceId'),','))]\",\r\n \"varALZWebhookServiceUri\": \"[[array(split(parameters('ALZWebhookServiceUri'),','))]\",\r\n \"varLogicAppReceivers\": [\r\n {\r\n \"name\": \"AlzLA-0\",\r\n \"resourceId\": \"[[if(empty(parameters('ALZLogicappResourceId')), null(), trim(parameters('ALZLogicappResourceId')))]\",\r\n \"callbackUrl\": \"[[if(empty(parameters('ALZLogicappCallbackUrl')), null(), trim(parameters('ALZLogicappCallbackUrl')))]\",\r\n \"useCommonSchema\": true\r\n }\r\n ],\r\n \"varAzureFunctionReceivers\": [\r\n {\r\n \"name\": \"AlzFa-0\",\r\n \"functionAppResourceId\": \"[[if(empty(parameters('ALZFunctionResourceId')), null(), split(trim(parameters('ALZFunctionResourceId')),'/functions/')[0])]\",\r\n \"functionName\": \"[[if(empty(parameters('ALZFunctionResourceId')), null(), split(trim(parameters('ALZFunctionResourceId')),'/')[10])]\",\r\n \"httpTriggerUrl\": \"[[if(empty(parameters('ALZFunctionTriggerUrl')), null(), trim(parameters('ALZFunctionTriggerUrl')))]\",\r\n \"useCommonAlertSchema\": true\r\n }\r\n ],\r\n \"copy\": [\r\n {\r\n \"name\": \"varEmailReceivers\",\r\n \"count\": \"[[length(variables('varALZMonitorActionGroupEmail'))]\",\r\n \"mode\": \"serial\",\r\n \"input\": {\r\n \"name\": \"[[concat('AlzMail-', indexOf(variables('varALZMonitorActionGroupEmail'), variables('varALZMonitorActionGroupEmail')[copyIndex('varEmailReceivers')]))]\",\r\n \"emailAddress\": \"[[trim(variables('varALZMonitorActionGroupEmail')[copyIndex('varEmailReceivers')])]\",\r\n \"useCommonSchema\": true\r\n }\r\n },\r\n {\r\n \"name\": \"varArmRoleReceivers\",\r\n \"count\": \"[[length(variables('varALZArmRoleId'))]\",\r\n \"mode\": \"serial\",\r\n \"input\": {\r\n \"name\": \"[[concat('AlzARM-', indexOf(variables('varALZArmRoleId'), variables('varALZArmRoleId')[copyIndex('varArmRoleReceivers')]))]\",\r\n \"roleId\": \"[[trim(variables('varALZArmRoleId')[copyIndex('varArmRoleReceivers')])]\",\r\n \"useCommonSchema\": true\r\n }\r\n },\r\n {\r\n \"name\": \"varEventHubReceivers\",\r\n \"count\": \"[[length(variables('varALZEventHubResourceId'))]\",\r\n \"mode\": \"serial\",\r\n \"input\": {\r\n \"name\": \"[[concat('AlzEH-', indexOf(variables('varALZEventHubResourceId'), variables('varALZEventHubResourceId')[copyIndex('varEventHubReceivers')]))]\",\r\n \"subscriptionId\": \"[[if(empty(parameters('ALZEventHubResourceId')), null(), split(trim(variables('varALZEventHubResourceId')[copyIndex('varEventHubReceivers')]),'/')[2])]\",\r\n \"eventHubNameSpace\": \"[[if(empty(parameters('ALZEventHubResourceId')), null(), split(trim(variables('varALZEventHubResourceId')[copyIndex('varEventHubReceivers')]),'/')[8])]\",\r\n \"eventHubName\": \"[[if(empty(parameters('ALZEventHubResourceId')), null(), split(trim(variables('varALZEventHubResourceId')[copyIndex('varEventHubReceivers')]),'/')[10])]\",\r\n \"useCommonAlertSchema\": true,\r\n \"tenantId\": \"[[subscription().tenantId]\"\r\n }\r\n },\r\n {\r\n \"name\": \"varWebhookReceivers\",\r\n \"count\": \"[[length(variables('varALZWebhookServiceUri'))]\",\r\n \"mode\": \"serial\",\r\n \"input\": {\r\n \"name\": \"[[concat('AlzWh-', indexOf(variables('varALZWebhookServiceUri'), variables('varALZWebhookServiceUri')[copyIndex('varWebhookReceivers')]))]\",\r\n \"identifierUri\": \"null()\",\r\n \"objectId\": \"null()\",\r\n \"serviceUri\": \"[[trim(variables('varALZWebhookServiceUri')[copyIndex('varWebhookReceivers')])]\",\r\n \"useCommonAlertSchema\": true,\r\n \"tenantId\": \"null()\",\r\n \"useAadAuth\": \"false\"\r\n }\r\n },\r\n {\r\n \"name\": \"varAGIds\",\r\n \"count\": \"[[length(variables('varBYOAGs'))]\",\r\n \"mode\": \"serial\",\r\n \"input\": \"[[trim(variables('varBYOAGs')[copyIndex('varAGIds')])]\"\r\n }\r\n ]\r\n },\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('ALZMonitorResourceGroupName')]\",\r\n \"location\": \"[[parameters('ALZMonitorResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('ALZMonitorResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"ActionGroupDeployment\",\r\n \"resourceGroup\": \"[[parameters('ALZMonitorResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('ALZMonitorResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"ALZMonitorResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"ALZMonitorActionGroupEmail\": {\r\n \"type\": \"string\"\r\n },\r\n \"ALZLogicappResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"ALZLogicappCallbackUrl\": {\r\n \"type\": \"string\"\r\n },\r\n \"ALZArmRoleId\": {\r\n \"type\": \"string\"\r\n },\r\n \"ALZEventHubResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"ALZWebhookServiceUri\": {\r\n \"type\": \"string\"\r\n },\r\n \"ALZFunctionResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"ALZFunctionTriggerUrl\": {\r\n \"type\": \"string\"\r\n },\r\n \"BYOActionGroup\": {\r\n \"type\": \"string\"\r\n },\r\n \"BYOAlertProcessingRule\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"condition\": \"[[and(empty(parameters('BYOActionGroup')), empty(parameters('BYOAlertProcessingRule')))]\",\r\n \"type\": \"Microsoft.Insights/actionGroups\",\r\n \"apiVersion\": \"2023-01-01\",\r\n \"name\": \"[[concat('ag-AMBA-', subscription().displayName, '-001')]\",\r\n \"location\": \"Global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"groupShortName\": \"ActGrp\",\r\n \"enabled\": true,\r\n \"emailReceivers\": \"[[if(empty(parameters('ALZMonitorActionGroupEmail')), null(), variables('varEmailReceivers'))]\",\r\n \"armRoleReceivers\": \"[[if(empty(parameters('ALZArmRoleId')), null(), variables('varArmRoleReceivers'))]\",\r\n \"logicAppReceivers\": \"[[if(empty(parameters('ALZLogicappResourceId')), null(), variables('varLogicAppReceivers'))]\",\r\n \"eventHubReceivers\": \"[[if(empty(parameters('ALZEventHubResourceId')), null(), variables('varEventHubReceivers'))]\",\r\n \"webhookReceivers\": \"[[if(empty(parameters('ALZWebhookServiceUri')), null(), variables('varWebhookReceivers'))]\",\r\n \"azureFunctionReceivers\": \"[[if(empty(parameters('ALZFunctionResourceId')), null(), variables('varAzureFunctionReceivers'))]\"\r\n }\r\n },\r\n {\r\n \"condition\": \"[[empty(parameters('BYOAlertProcessingRule'))]\",\r\n \"type\": \"Microsoft.AlertsManagement/actionRules\",\r\n \"apiVersion\": \"2021-08-08\",\r\n \"name\": \"[[concat('apr-AMBA-',subscription().displayName, '-001')]\",\r\n \"location\": \"Global\",\r\n \"dependsOn\": [\r\n \"[[concat('ag-AMBA-', subscription().displayName, '-001')]\"\r\n ],\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"description\": \"AMBA Notification Assets - Alert Processing Rule for Subscription\",\r\n \"enabled\": true,\r\n \"actions\": [\r\n {\r\n \"actiongroupIds\": \"[[if(empty(parameters('BYOActionGroup')), array(concat(subscription().Id, '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/microsoft.insights/actionGroups/', 'ag-AMBA-', subscription().displayName, '-001')), variables('varAGIds'))]\",\r\n \"actionType\": \"AddActionGroups\"\r\n }\r\n ]\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"ALZMonitorResourceGroupName\": {\r\n \"value\": \"[[parameters('ALZMonitorResourceGroupName')]\"\r\n },\r\n \"ALZMonitorActionGroupEmail\": {\r\n \"value\": \"[[parameters('ALZMonitorActionGroupEmail')]\"\r\n },\r\n \"ALZLogicappResourceId\": {\r\n \"value\": \"[[parameters('ALZLogicappResourceId')]\"\r\n },\r\n \"ALZLogicappCallbackUrl\": {\r\n \"value\": \"[[parameters('ALZLogicappCallbackUrl')]\"\r\n },\r\n \"ALZArmRoleId\": {\r\n \"value\": \"[[parameters('ALZArmRoleId')]\"\r\n },\r\n \"ALZEventHubResourceId\": {\r\n \"value\": \"[[parameters('ALZEventHubResourceId')]\"\r\n },\r\n \"ALZWebhookServiceUri\": {\r\n \"value\": \"[[parameters('ALZWebhookServiceUri')]\"\r\n },\r\n \"ALZFunctionResourceId\": {\r\n \"value\": \"[[parameters('ALZFunctionResourceId')]\"\r\n },\r\n \"ALZFunctionTriggerUrl\": {\r\n \"value\": \"[[parameters('ALZFunctionTriggerUrl')]\"\r\n },\r\n \"BYOActionGroup\": {\r\n \"value\": \"[[parameters('BYOActionGroup')]\"\r\n },\r\n \"BYOAlertProcessingRule\": {\r\n \"value\": \"[[parameters('BYOAlertProcessingRule')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"ALZMonitorResourceGroupName\": {\r\n \"value\": \"[[parameters('ALZMonitorResourceGroupName')]\"\r\n },\r\n \"ALZMonitorResourceGroupTags\": {\r\n \"value\": \"[[parameters('ALZMonitorResourceGroupTags')]\"\r\n },\r\n \"ALZMonitorResourceGroupLocation\": {\r\n \"value\": \"[[parameters('ALZMonitorResourceGroupLocation')]\"\r\n },\r\n \"ALZMonitorActionGroupEmail\": {\r\n \"value\": \"[[parameters('ALZMonitorActionGroupEmail')]\"\r\n },\r\n \"ALZLogicappResourceId\": {\r\n \"value\": \"[[parameters('ALZLogicappResourceId')]\"\r\n },\r\n \"ALZLogicappCallbackUrl\": {\r\n \"value\": \"[[parameters('ALZLogicappCallbackUrl')]\"\r\n },\r\n \"ALZArmRoleId\": {\r\n \"value\": \"[[parameters('ALZArmRoleId')]\"\r\n },\r\n \"ALZEventHubResourceId\": {\r\n \"value\": \"[[parameters('ALZEventHubResourceId')]\"\r\n },\r\n \"ALZWebhookServiceUri\": {\r\n \"value\": \"[[parameters('ALZWebhookServiceUri')]\"\r\n },\r\n \"ALZFunctionResourceId\": {\r\n \"value\": \"[[parameters('ALZFunctionResourceId')]\"\r\n },\r\n \"ALZFunctionTriggerUrl\": {\r\n \"value\": \"[[parameters('ALZFunctionTriggerUrl')]\"\r\n },\r\n \"BYOActionGroup\": {\r\n \"value\": \"[[parameters('BYOActionGroup')]\"\r\n },\r\n \"BYOAlertProcessingRule\": {\r\n \"value\": \"[[parameters('BYOAlertProcessingRule')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#108": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Suppression_AlertProcessing_Rule\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy AMBA Notification Suppression Asset\",\r\n \"description\": \"Policy to deploy empty and disabled suppression Alert Processing Rule for all AMBA alerts\",\r\n \"metadata\": {\r\n \"version\": \"1.0.0\",\r\n \"category\": \"Monitoring\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"ALZMonitorResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"ALZMonitorResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"_deployed_by_amba\": true\r\n }\r\n },\r\n \"ALZMonitorResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Monitoring disabled\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Resources/subscriptions\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"deployIfNotExists\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.AlertsManagement/actionRules\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('ALZMonitorResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.AlertsManagement/actionRules/description\",\r\n \"equals\": \"AMBA Notification Assets - Suppression Alert Processing Rule for maintenance period for Subscription\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"ALZMonitorResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"ALZMonitorResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"ALZMonitorResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {\r\n },\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('ALZMonitorResourceGroupName')]\",\r\n \"location\": \"[[parameters('ALZMonitorResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('ALZMonitorResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"SuppressionRuleDeployment\",\r\n \"resourceGroup\": \"[[parameters('ALZMonitorResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('ALZMonitorResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"ALZMonitorResourceGroupName\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.AlertsManagement/actionRules\",\r\n \"apiVersion\": \"2021-08-08\",\r\n \"name\": \"[[concat('apr-AMBA-',subscription().displayName, '-002')]\",\r\n \"location\": \"Global\",\r\n \"dependsOn\": [\r\n ],\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"description\": \"AMBA Notification Assets - Suppression Alert Processing Rule for maintenance period for Subscription\",\r\n \"enabled\": false,\r\n \"actions\": [\r\n {\r\n \"actionType\": \"RemoveAllActionGroups\"\r\n }\r\n ]\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"ALZMonitorResourceGroupName\": {\r\n \"value\": \"[[parameters('ALZMonitorResourceGroupName')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"ALZMonitorResourceGroupName\": {\r\n \"value\": \"[[parameters('ALZMonitorResourceGroupName')]\"\r\n },\r\n \"ALZMonitorResourceGroupTags\": {\r\n \"value\": \"[[parameters('ALZMonitorResourceGroupTags')]\"\r\n },\r\n \"ALZMonitorResourceGroupLocation\": {\r\n \"value\": \"[[parameters('ALZMonitorResourceGroupLocation')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#109": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_ServiceHealth_ActionGroups\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Service Health Action Group\",\r\n \"description\": \"Policy to deploy action group for Service Health alerts\",\r\n \"metadata\": {\r\n \"version\": \"1.2.0\",\r\n \"category\": \"Monitoring\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Monitoring disabled\",\r\n \"description\": \"Tag name to disable monitoring Subscription level alerts. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"ALZMonitorResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"ALZMonitorResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"_deployed_by_amba\": true\r\n }\r\n },\r\n \"ALZMonitorResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"ALZMonitorActionGroupEmail\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Action Group Email Addresses\",\r\n \"description\": \"Email addresses to send alerts to\"\r\n },\r\n \"defaultValue\": \"\"\r\n },\r\n \"ALZLogicappResourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Logic App Resource Id\",\r\n \"description\": \"Logic App Resource Id for Action Group to send alerts to\"\r\n },\r\n \"defaultValue\": \"\"\r\n },\r\n \"ALZLogicappCallbackUrl\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Logic App Callback URL\",\r\n \"description\": \"Callback URL that triggers the Logic App\"\r\n },\r\n \"defaultValue\": \"\"\r\n },\r\n \"ALZArmRoleId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Arm Role Id\",\r\n \"description\": \"Arm Built-in Role Id for action group to send alerts to a subscription level, will only send to individual members of role\"\r\n },\r\n \"defaultValue\": \"\"\r\n },\r\n \"ALZEventHubResourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Event Hub resource id\",\r\n \"description\": \"Event Hub resource id for action group to send alerts to\"\r\n },\r\n \"defaultValue\": \"\"\r\n },\r\n \"ALZWebhookServiceUri\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Webhook Service Uri\",\r\n \"description\": \"Indicates the service uri of the webhook to send alerts to\"\r\n },\r\n \"defaultValue\": \"\"\r\n },\r\n \"ALZFunctionResourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Function Resource Id\",\r\n \"description\": \"Function Resource Id for Action Group to send alerts to\"\r\n },\r\n \"defaultValue\": \"\"\r\n },\r\n \"ALZFunctionTriggerUrl\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Function Trigger URL\",\r\n \"description\": \"URL that triggers the Function\"\r\n },\r\n \"defaultValue\": \"\"\r\n },\r\n \"BYOActionGroup\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Customer defined Action Group Resource ID\",\r\n \"description\": \"The Resource ID of an existing Action Group already deployed by the customer in his environment\"\r\n },\r\n \"defaultValue\": \"\"\r\n },\r\n \"BYOAlertProcessingRule\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Customer defined Alert Processing Rule Resource ID\",\r\n \"description\": \"The Resource ID of an existing Alert Processing Rule already deployed by the customer in his environment\"\r\n },\r\n \"defaultValue\": \"\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Resources/subscriptions\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n },\r\n {\r\n \"value\": \"[[empty(parameters('BYOActionGroup'))]\",\r\n \"equals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"deployIfNotExists\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/actionGroups\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('ALZMonitorResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"value\": \"[[empty(parameters('BYOActionGroup'))]\",\r\n \"equals\": true\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/actionGroups/groupShortName\",\r\n \"equals\": \"SH-ActGrp\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"ALZMonitorResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"ALZMonitorResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"ALZMonitorResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"ALZMonitorActionGroupEmail\": {\r\n \"type\": \"string\"\r\n },\r\n \"ALZLogicappResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"ALZLogicappCallbackUrl\": {\r\n \"type\": \"String\"\r\n },\r\n \"ALZArmRoleId\": {\r\n \"type\": \"string\"\r\n },\r\n \"ALZEventHubResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"ALZWebhookServiceUri\": {\r\n \"type\": \"string\"\r\n },\r\n \"ALZFunctionResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"ALZFunctionTriggerUrl\": {\r\n \"type\": \"String\"\r\n },\r\n \"BYOActionGroup\": {\r\n \"type\": \"String\"\r\n },\r\n \"BYOAlertProcessingRule\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {\r\n \"varALZMonitorActionGroupEmail\": \"[[array(split(parameters('ALZMonitorActionGroupEmail'),','))]\",\r\n \"varALZArmRoleId\": \"[[array(split(parameters('ALZArmRoleId'),','))]\",\r\n \"varALZEventHubResourceId\": \"[[array(split(parameters('ALZEventHubResourceId'),','))]\",\r\n \"varALZWebhookServiceUri\": \"[[array(split(parameters('ALZWebhookServiceUri'),','))]\",\r\n \"varLogicAppReceivers\": [\r\n {\r\n \"name\": \"AlzLA-0\",\r\n \"resourceId\": \"[[if(empty(parameters('ALZLogicappResourceId')), null(), trim(parameters('ALZLogicappResourceId')))]\",\r\n \"callbackUrl\": \"[[if(empty(parameters('ALZLogicappCallbackUrl')), null(), trim(parameters('ALZLogicappCallbackUrl')))]\",\r\n \"useCommonSchema\": true\r\n }\r\n ],\r\n \"varAzureFunctionReceivers\": [\r\n {\r\n \"name\": \"AlzFa-0\",\r\n \"functionAppResourceId\": \"[[if(empty(parameters('ALZFunctionResourceId')), null(), split(trim(parameters('ALZFunctionResourceId')),'/functions/')[0])]\",\r\n \"functionName\": \"[[if(empty(parameters('ALZFunctionResourceId')), null(), split(trim(parameters('ALZFunctionResourceId')),'/')[10])]\",\r\n \"httpTriggerUrl\": \"[[if(empty(parameters('ALZFunctionTriggerUrl')), null(), trim(parameters('ALZFunctionTriggerUrl')))]\",\r\n \"useCommonAlertSchema\": true\r\n }\r\n ],\r\n \"copy\": [\r\n {\r\n \"name\": \"varEmailReceivers\",\r\n \"count\": \"[[length(variables('varALZMonitorActionGroupEmail'))]\",\r\n \"mode\": \"serial\",\r\n \"input\": {\r\n \"name\": \"[[concat('AlzMail-', indexOf(variables('varALZMonitorActionGroupEmail'), variables('varALZMonitorActionGroupEmail')[copyIndex('varEmailReceivers')]))]\",\r\n \"emailAddress\": \"[[trim(variables('varALZMonitorActionGroupEmail')[copyIndex('varEmailReceivers')])]\",\r\n \"useCommonSchema\": true\r\n }\r\n },\r\n {\r\n \"name\": \"varArmRoleReceivers\",\r\n \"count\": \"[[length(variables('varALZArmRoleId'))]\",\r\n \"mode\": \"serial\",\r\n \"input\": {\r\n \"name\": \"[[concat('AlzARM-', indexOf(variables('varALZArmRoleId'), variables('varALZArmRoleId')[copyIndex('varArmRoleReceivers')]))]\",\r\n \"roleId\": \"[[trim(variables('varALZArmRoleId')[copyIndex('varArmRoleReceivers')])]\",\r\n \"useCommonSchema\": true\r\n }\r\n },\r\n {\r\n \"name\": \"varEventHubReceivers\",\r\n \"count\": \"[[length(variables('varALZEventHubResourceId'))]\",\r\n \"mode\": \"serial\",\r\n \"input\": {\r\n \"name\": \"[[concat('AlzEH-', indexOf(variables('varALZEventHubResourceId'), variables('varALZEventHubResourceId')[copyIndex('varEventHubReceivers')]))]\",\r\n \"subscriptionId\": \"[[if(empty(parameters('ALZEventHubResourceId')), null(), split(trim(variables('varALZEventHubResourceId')[copyIndex('varEventHubReceivers')]),'/')[2])]\",\r\n \"eventHubNameSpace\": \"[[if(empty(parameters('ALZEventHubResourceId')), null(), split(trim(variables('varALZEventHubResourceId')[copyIndex('varEventHubReceivers')]),'/')[8])]\",\r\n \"eventHubName\": \"[[if(empty(parameters('ALZEventHubResourceId')), null(), split(trim(variables('varALZEventHubResourceId')[copyIndex('varEventHubReceivers')]),'/')[10])]\",\r\n \"useCommonAlertSchema\": true,\r\n \"tenantId\": \"[[subscription().tenantId]\"\r\n }\r\n },\r\n {\r\n \"name\": \"varWebhookReceivers\",\r\n \"count\": \"[[length(variables('varALZWebhookServiceUri'))]\",\r\n \"mode\": \"serial\",\r\n \"input\": {\r\n \"name\": \"[[concat('AlzWh-', indexOf(variables('varALZWebhookServiceUri'), variables('varALZWebhookServiceUri')[copyIndex('varWebhookReceivers')]))]\",\r\n \"identifierUri\": \"null()\",\r\n \"objectId\": \"null()\",\r\n \"serviceUri\": \"[[trim(variables('varALZWebhookServiceUri')[copyIndex('varWebhookReceivers')])]\",\r\n \"useCommonAlertSchema\": true,\r\n \"tenantId\": \"null()\",\r\n \"useAadAuth\": \"false\"\r\n }\r\n }\r\n ]\r\n },\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('ALZMonitorResourceGroupName')]\",\r\n \"location\": \"[[parameters('ALZMonitorResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('ALZMonitorResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"SH-ActionGroupDeployment\",\r\n \"resourceGroup\": \"[[parameters('ALZMonitorResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('ALZMonitorResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"ALZMonitorResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"ALZMonitorActionGroupEmail\": {\r\n \"type\": \"string\"\r\n },\r\n \"ALZLogicappResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"ALZLogicappCallbackUrl\": {\r\n \"type\": \"string\"\r\n },\r\n \"ALZArmRoleId\": {\r\n \"type\": \"string\"\r\n },\r\n \"ALZEventHubResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"ALZWebhookServiceUri\": {\r\n \"type\": \"string\"\r\n },\r\n \"ALZFunctionResourceId\": {\r\n \"type\": \"string\"\r\n },\r\n \"ALZFunctionTriggerUrl\": {\r\n \"type\": \"string\"\r\n },\r\n \"BYOActionGroup\": {\r\n \"type\": \"string\"\r\n },\r\n \"BYOAlertProcessingRule\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"condition\": \"[[empty(parameters('BYOActionGroup'))]\",\r\n \"type\": \"Microsoft.Insights/actionGroups\",\r\n \"apiVersion\": \"2023-01-01\",\r\n \"name\": \"[[concat('ag-AMBA-SH-', subscription().displayName, '-001')]\",\r\n \"location\": \"Global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"groupShortName\": \"SH-ActGrp\",\r\n \"enabled\": true,\r\n \"emailReceivers\": \"[[if(empty(parameters('ALZMonitorActionGroupEmail')), null(), variables('varEmailReceivers'))]\",\r\n \"armRoleReceivers\": \"[[if(empty(parameters('ALZArmRoleId')), null(), variables('varArmRoleReceivers'))]\",\r\n \"logicAppReceivers\": \"[[if(empty(parameters('ALZLogicappResourceId')), null(), variables('varLogicAppReceivers'))]\",\r\n \"eventHubReceivers\": \"[[if(empty(parameters('ALZEventHubResourceId')), null(), variables('varEventHubReceivers'))]\",\r\n \"webhookReceivers\": \"[[if(empty(parameters('ALZWebhookServiceUri')), null(), variables('varWebhookReceivers'))]\",\r\n \"azureFunctionReceivers\": \"[[if(empty(parameters('ALZFunctionResourceId')), null(), variables('varAzureFunctionReceivers'))]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"ALZMonitorResourceGroupName\": {\r\n \"value\": \"[[parameters('ALZMonitorResourceGroupName')]\"\r\n },\r\n \"ALZMonitorActionGroupEmail\": {\r\n \"value\": \"[[parameters('ALZMonitorActionGroupEmail')]\"\r\n },\r\n \"ALZLogicappResourceId\": {\r\n \"value\": \"[[parameters('ALZLogicappResourceId')]\"\r\n },\r\n \"ALZLogicappCallbackUrl\": {\r\n \"value\": \"[[parameters('ALZLogicappCallbackUrl')]\"\r\n },\r\n \"ALZArmRoleId\": {\r\n \"value\": \"[[parameters('ALZArmRoleId')]\"\r\n },\r\n \"ALZEventHubResourceId\": {\r\n \"value\": \"[[parameters('ALZEventHubResourceId')]\"\r\n },\r\n \"ALZWebhookServiceUri\": {\r\n \"value\": \"[[parameters('ALZWebhookServiceUri')]\"\r\n },\r\n \"ALZFunctionResourceId\": {\r\n \"value\": \"[[parameters('ALZFunctionResourceId')]\"\r\n },\r\n \"ALZFunctionTriggerUrl\": {\r\n \"value\": \"[[parameters('ALZFunctionTriggerUrl')]\"\r\n },\r\n \"BYOActionGroup\": {\r\n \"value\": \"[[parameters('BYOActionGroup')]\"\r\n },\r\n \"BYOAlertProcessingRule\": {\r\n \"value\": \"[[parameters('BYOAlertProcessingRule')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"ALZMonitorResourceGroupName\": {\r\n \"value\": \"[[parameters('ALZMonitorResourceGroupName')]\"\r\n },\r\n \"ALZMonitorResourceGroupTags\": {\r\n \"value\": \"[[parameters('ALZMonitorResourceGroupTags')]\"\r\n },\r\n \"ALZMonitorResourceGroupLocation\": {\r\n \"value\": \"[[parameters('ALZMonitorResourceGroupLocation')]\"\r\n },\r\n \"ALZMonitorActionGroupEmail\": {\r\n \"value\": \"[[parameters('ALZMonitorActionGroupEmail')]\"\r\n },\r\n \"ALZLogicappResourceId\": {\r\n \"value\": \"[[parameters('ALZLogicappResourceId')]\"\r\n },\r\n \"ALZLogicappCallbackUrl\": {\r\n \"value\": \"[[parameters('ALZLogicappCallbackUrl')]\"\r\n },\r\n \"ALZArmRoleId\": {\r\n \"value\": \"[[parameters('ALZArmRoleId')]\"\r\n },\r\n \"ALZEventHubResourceId\": {\r\n \"value\": \"[[parameters('ALZEventHubResourceId')]\"\r\n },\r\n \"ALZWebhookServiceUri\": {\r\n \"value\": \"[[parameters('ALZWebhookServiceUri')]\"\r\n },\r\n \"ALZFunctionResourceId\": {\r\n \"value\": \"[[parameters('ALZFunctionResourceId')]\"\r\n },\r\n \"ALZFunctionTriggerUrl\": {\r\n \"value\": \"[[parameters('ALZFunctionTriggerUrl')]\"\r\n },\r\n \"BYOActionGroup\": {\r\n \"value\": \"[[parameters('BYOActionGroup')]\"\r\n },\r\n \"BYOAlertProcessingRule\": {\r\n \"value\": \"[[parameters('BYOAlertProcessingRule')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#11": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_ERGw_ExpressRouteBitsOut_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy ERG ExpressRoute Bits Out Alert\",\r\n \"description\": \"Policy to audit/deploy ER Gateway Connection BitsOutPerSecond Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.0\",\r\n \"category\": \"Network\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"0\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"disabled\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/expressroutegateways\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/expressroutegateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"ERGatewayConnectionBitsOutPerSecond\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/expressroutegateways/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"LessThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-GatewayERBitsOutAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for ER Gateway Connection BitsOutPerSecond\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"ERGatewayConnectionBitsOutPerSecond\",\r\n \"metricNamespace\": \"Microsoft.Network/expressroutegateways\",\r\n \"metricName\": \"ERGatewayConnectionBitsOutPerSecond\",\r\n \"operator\": \"LessThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#110": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_activitylog_ResourceHealth_Unhealthy_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Resource Health Unhealthy Alert\",\r\n \"description\": \"Policy to Deploy Resource Health Unhealthy Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.0\",\r\n \"category\": \"Monitoring\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"_deployed_by_amba\": true\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"disabled\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Monitoring disabled\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"BYOActionGroup\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Customer defined Action Group Resource ID\",\r\n \"description\": \"The Resource ID of an existing Action Group already deployed by the customer in his environment\"\r\n },\r\n \"defaultValue\": \"\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Resources/subscriptions\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/activityLogAlerts\",\r\n \"existenceScope\": \"resourcegroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"anyOf\": [\r\n {\r\n \"allOf\": [\r\n {\r\n \"value\": \"[[empty(parameters('BYOActionGroup'))]\",\r\n \"equals\": true\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/actions.actionGroups[*].actionGroupId\",\r\n \"contains\": \"ag-AMBA-SH-\"\r\n }\r\n ]\r\n },\r\n {\r\n \"allOf\": [\r\n {\r\n \"value\": \"[[empty(parameters('BYOActionGroup'))]\",\r\n \"equals\": false\r\n },\r\n {\r\n \"count\": {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/actions.actionGroups[*]\",\r\n \"where\": {\r\n \"anyOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/actions.actionGroups[*].actionGroupId\",\r\n \"contains\": \"[[split(trim(parameters('BYOActionGroup')),',')[0]]\"\r\n }\r\n ]\r\n }\r\n },\r\n \"equals\": 1\r\n }\r\n ]\r\n }\r\n ]\r\n },\r\n {\r\n \"count\": {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*]\",\r\n \"where\": {\r\n \"anyOf\": [\r\n {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].field\",\r\n \"equals\": \"category\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].equals\",\r\n \"equals\": \"ResourceHealth\"\r\n }\r\n ]\r\n }\r\n ]\r\n }\r\n },\r\n \"equals\": 1\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"BYOActionGroup\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {\r\n \"varBYOActionGroups\": \"[[split(parameters('BYOActionGroup'), ',')]\",\r\n \"copy\": [\r\n {\r\n \"name\": \"varActionGroupIds\",\r\n \"count\": \"[[length(variables('varBYOActionGroups'))]\",\r\n \"mode\": \"serial\",\r\n \"input\": {\r\n \"actionGroupId\": \"[[trim(variables('varBYOActionGroups')[copyIndex('varActionGroupIds')])]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"ResourceHealtAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[resourceId('Microsoft.Resources/resourceGroups', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"BYOActionGroup\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"condition\": \"[[empty(parameters('BYOActionGroup'))]\",\r\n \"type\": \"microsoft.insights/activityLogAlerts\",\r\n \"apiVersion\": \"2020-10-01\",\r\n \"name\": \"ResourceHealthUnhealthyAlert\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"actions\": {\r\n \"actionGroups\": [\r\n {\r\n \"actionGroupId\": \"[[concat(subscription().Id, '/resourceGroups/', parameters('alertResourceGroupName'), '/providers/microsoft.insights/actionGroups/', 'ag-AMBA-SH-', subscription().displayName, '-001')]\",\r\n \"webhookProperties\": {}\r\n }\r\n ]\r\n },\r\n \"description\": \"Resource Health Unhealthy Alert\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().id]\"\r\n ],\r\n \"condition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"category\",\r\n \"equals\": \"ResourceHealth\"\r\n },\r\n {\r\n \"anyOf\": [\r\n {\r\n \"field\": \"properties.cause\",\r\n \"equals\": \"PlatformInitiated\"\r\n },\r\n {\r\n \"field\": \"properties.cause\",\r\n \"equals\": \"UserInitiated\"\r\n }\r\n ]\r\n },\r\n {\r\n \"anyOf\": [\r\n {\r\n \"field\": \"properties.currentHealthStatus\",\r\n \"equals\": \"Degraded\"\r\n },\r\n {\r\n \"field\": \"properties.currentHealthStatus\",\r\n \"equals\": \"Unavailable\"\r\n }\r\n ]\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n },\r\n {\r\n \"condition\": \"[[not(empty(parameters('BYOActionGroup')))]\",\r\n \"type\": \"microsoft.insights/activityLogAlerts\",\r\n \"apiVersion\": \"2020-10-01\",\r\n \"name\": \"ResourceHealthUnhealthyAlert\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"actions\": {\r\n \"actionGroups\": \"[[variables('varActionGroupIds')]\"\r\n },\r\n \"description\": \"Resource Health Unhealthy Alert\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().id]\"\r\n ],\r\n \"condition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"category\",\r\n \"equals\": \"ResourceHealth\"\r\n },\r\n {\r\n \"anyOf\": [\r\n {\r\n \"field\": \"properties.cause\",\r\n \"equals\": \"PlatformInitiated\"\r\n },\r\n {\r\n \"field\": \"properties.cause\",\r\n \"equals\": \"UserInitiated\"\r\n }\r\n ]\r\n },\r\n {\r\n \"anyOf\": [\r\n {\r\n \"field\": \"properties.currentHealthStatus\",\r\n \"equals\": \"Degraded\"\r\n },\r\n {\r\n \"field\": \"properties.currentHealthStatus\",\r\n \"equals\": \"Unavailable\"\r\n }\r\n ]\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"BYOActionGroup\": {\r\n \"value\": \"[[parameters('BYOActionGroup')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"BYOActionGroup\": {\r\n \"value\": \"[[parameters('BYOActionGroup')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#111": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_activitylog_ServiceHealth_HealthAdvisory\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Service Health Advisory Alert\",\r\n \"description\": \"Policy to Deploy Service Health Advisory Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.0\",\r\n \"category\": \"Monitoring\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"_deployed_by_amba\": true\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"disabled\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Monitoring disabled\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"ALZMonitorActionGroupEmail\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Action Group Email Addresses\",\r\n \"description\": \"Email addresses to send alerts to\"\r\n },\r\n \"defaultValue\": \"\"\r\n },\r\n \"BYOActionGroup\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Customer defined Action Group Resource ID\",\r\n \"description\": \"The Resource ID of an existing Action Group already deployed by the customer in his environment\"\r\n },\r\n \"defaultValue\": \"\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Resources/subscriptions\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/activityLogAlerts\",\r\n \"existenceScope\": \"resourceGroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"anyOf\": [\r\n {\r\n \"allOf\": [\r\n {\r\n \"value\": \"[[empty(parameters('BYOActionGroup'))]\",\r\n \"equals\": true\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/actions.actionGroups[*].actionGroupId\",\r\n \"contains\": \"ag-AMBA-SH-\"\r\n }\r\n ]\r\n },\r\n {\r\n \"allOf\": [\r\n {\r\n \"value\": \"[[empty(parameters('BYOActionGroup'))]\",\r\n \"equals\": false\r\n },\r\n {\r\n \"count\": {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/actions.actionGroups[*]\",\r\n \"where\": {\r\n \"anyOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/actions.actionGroups[*].actionGroupId\",\r\n \"contains\": \"[[split(trim(parameters('BYOActionGroup')),',')[0]]\"\r\n }\r\n ]\r\n }\r\n },\r\n \"equals\": 1\r\n }\r\n ]\r\n }\r\n ]\r\n },\r\n {\r\n \"count\": {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*]\",\r\n \"where\": {\r\n \"anyOf\": [\r\n {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].field\",\r\n \"equals\": \"category\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].equals\",\r\n \"equals\": \"ServiceHealth\"\r\n }\r\n ]\r\n },\r\n {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].field\",\r\n \"equals\": \"properties.incidentType\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].equals\",\r\n \"equals\": \"ActionRequired\"\r\n }\r\n ]\r\n }\r\n ]\r\n }\r\n },\r\n \"equals\": 2\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"ALZMonitorActionGroupEmail\": {\r\n \"type\": \"string\"\r\n },\r\n \"BYOActionGroup\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {\r\n \"varBYOActionGroups\": \"[[split(parameters('BYOActionGroup'), ',')]\",\r\n \"copy\": [\r\n {\r\n \"name\": \"varActionGroupIds\",\r\n \"count\": \"[[length(variables('varBYOActionGroups'))]\",\r\n \"mode\": \"serial\",\r\n \"input\": {\r\n \"actionGroupId\": \"[[trim(variables('varBYOActionGroups')[copyIndex('varActionGroupIds')])]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"ServiceHealthHealth\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[resourceId('Microsoft.Resources/resourceGroups', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"ALZMonitorActionGroupEmail\": {\r\n \"type\": \"string\"\r\n },\r\n \"BYOActionGroup\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"condition\": \"[[empty(parameters('BYOActionGroup'))]\",\r\n \"type\": \"microsoft.insights/activityLogAlerts\",\r\n \"apiVersion\": \"2020-10-01\",\r\n \"name\": \"ServiceHealthAdvisoryEvent\",\r\n \"location\": \"Global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"actions\": {\r\n \"actionGroups\": [\r\n {\r\n \"actionGroupId\": \"[[concat(subscription().Id, '/resourceGroups/', parameters('alertResourceGroupName'), '/providers/microsoft.insights/actionGroups/', 'ag-AMBA-SH-', subscription().displayName, '-001')]\"\r\n }\r\n ]\r\n },\r\n \"description\": \"Service Health Advisory Alert\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().id]\"\r\n ],\r\n \"condition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"category\",\r\n \"equals\": \"ServiceHealth\"\r\n },\r\n {\r\n \"field\": \"properties.incidentType\",\r\n \"equals\": \"ActionRequired\"\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n },\r\n {\r\n \"condition\": \"[[not(empty(parameters('BYOActionGroup')))]\",\r\n \"type\": \"microsoft.insights/activityLogAlerts\",\r\n \"apiVersion\": \"2020-10-01\",\r\n \"name\": \"ServiceHealthAdvisoryEvent\",\r\n \"location\": \"Global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"actions\": {\r\n \"actionGroups\": \"[[variables('varActionGroupIds')]\"\r\n },\r\n \"description\": \"Service Health Advisory Alert\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().id]\"\r\n ],\r\n \"condition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"category\",\r\n \"equals\": \"ServiceHealth\"\r\n },\r\n {\r\n \"field\": \"properties.incidentType\",\r\n \"equals\": \"ActionRequired\"\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"ALZMonitorActionGroupEmail\": {\r\n \"value\": \"[[parameters('ALZMonitorActionGroupEmail')]\"\r\n },\r\n \"BYOActionGroup\": {\r\n \"value\": \"[[parameters('BYOActionGroup')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"ALZMonitorActionGroupEmail\": {\r\n \"value\": \"[[parameters('ALZMonitorActionGroupEmail')]\"\r\n },\r\n \"BYOActionGroup\": {\r\n \"value\": \"[[parameters('BYOActionGroup')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#112": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_activitylog_ServiceHealth_Incident\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Service Health Incident Alert\",\r\n \"description\": \"Policy to Deploy Service Health Incident Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.0\",\r\n \"category\": \"Monitoring\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"_deployed_by_amba\": true\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"disabled\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Monitoring disabled\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"ALZMonitorActionGroupEmail\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Action Group Email Addresses\",\r\n \"description\": \"Email addresses to send alerts to\"\r\n },\r\n \"defaultValue\": \"\"\r\n },\r\n \"BYOActionGroup\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Customer defined Action Group Resource ID\",\r\n \"description\": \"The Resource ID of an existing Action Group already deployed by the customer in his environment\"\r\n },\r\n \"defaultValue\": \"\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Resources/subscriptions\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/activityLogAlerts\",\r\n \"existenceScope\": \"resourcegroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"anyOf\": [\r\n {\r\n \"allOf\": [\r\n {\r\n \"value\": \"[[empty(parameters('BYOActionGroup'))]\",\r\n \"equals\": true\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/actions.actionGroups[*].actionGroupId\",\r\n \"contains\": \"ag-AMBA-SH-\"\r\n }\r\n ]\r\n },\r\n {\r\n \"allOf\": [\r\n {\r\n \"value\": \"[[empty(parameters('BYOActionGroup'))]\",\r\n \"equals\": false\r\n },\r\n {\r\n \"count\": {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/actions.actionGroups[*]\",\r\n \"where\": {\r\n \"anyOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/actions.actionGroups[*].actionGroupId\",\r\n \"contains\": \"[[split(trim(parameters('BYOActionGroup')),',')[0]]\"\r\n }\r\n ]\r\n }\r\n },\r\n \"equals\": 1\r\n }\r\n ]\r\n }\r\n ]\r\n },\r\n {\r\n \"count\": {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*]\",\r\n \"where\": {\r\n \"anyOf\": [\r\n {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].field\",\r\n \"equals\": \"category\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].equals\",\r\n \"equals\": \"ServiceHealth\"\r\n }\r\n ]\r\n },\r\n {\r\n \"allOf\": [\r\n {\r\n \"field\": \"microsoft.insights/activityLogAlerts/condition.allOf[*].field\",\r\n \"equals\": \"properties.incidentType\"\r\n },\r\n {\r\n \"field\": \"microsoft.insights/activityLogAlerts/condition.allOf[*].equals\",\r\n \"equals\": \"Incident\"\r\n }\r\n ]\r\n }\r\n ]\r\n }\r\n },\r\n \"equals\": 2\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"ALZMonitorActionGroupEmail\": {\r\n \"type\": \"string\"\r\n },\r\n \"BYOActionGroup\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {\r\n \"varBYOActionGroups\": \"[[split(parameters('BYOActionGroup'), ',')]\",\r\n \"copy\": [\r\n {\r\n \"name\": \"varActionGroupIds\",\r\n \"count\": \"[[length(variables('varBYOActionGroups'))]\",\r\n \"mode\": \"serial\",\r\n \"input\": {\r\n \"actionGroupId\": \"[[trim(variables('varBYOActionGroups')[copyIndex('varActionGroupIds')])]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"ServiceHealthIncident\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[resourceId('Microsoft.Resources/resourceGroups', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"ALZMonitorActionGroupEmail\": {\r\n \"type\": \"string\"\r\n },\r\n \"BYOActionGroup\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"condition\": \"[[empty(parameters('BYOActionGroup'))]\",\r\n \"type\": \"microsoft.insights/activityLogAlerts\",\r\n \"apiVersion\": \"2020-10-01\",\r\n \"name\": \"ServiceHealthIncident\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"actions\": {\r\n \"actionGroups\": [\r\n {\r\n \"actionGroupId\": \"[[concat(subscription().Id, '/resourceGroups/', parameters('alertResourceGroupName'), '/providers/microsoft.insights/actionGroups/', 'ag-AMBA-SH-', subscription().displayName, '-001')]\"\r\n }\r\n ]\r\n },\r\n \"description\": \"Service Health Incident Alert\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().id]\"\r\n ],\r\n \"condition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"category\",\r\n \"equals\": \"ServiceHealth\"\r\n },\r\n {\r\n \"field\": \"properties.incidentType\",\r\n \"equals\": \"Incident\"\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n },\r\n {\r\n \"condition\": \"[[not(empty(parameters('BYOActionGroup')))]\",\r\n \"type\": \"microsoft.insights/activityLogAlerts\",\r\n \"apiVersion\": \"2020-10-01\",\r\n \"name\": \"ServiceHealthIncident\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"actions\": {\r\n \"actionGroups\": \"[[variables('varActionGroupIds')]\"\r\n },\r\n \"description\": \"Service Health Incident Alert\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().id]\"\r\n ],\r\n \"condition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"category\",\r\n \"equals\": \"ServiceHealth\"\r\n },\r\n {\r\n \"field\": \"properties.incidentType\",\r\n \"equals\": \"Incident\"\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"ALZMonitorActionGroupEmail\": {\r\n \"value\": \"[[parameters('ALZMonitorActionGroupEmail')]\"\r\n },\r\n \"BYOActionGroup\": {\r\n \"value\": \"[[parameters('BYOActionGroup')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"ALZMonitorActionGroupEmail\": {\r\n \"value\": \"[[parameters('ALZMonitorActionGroupEmail')]\"\r\n },\r\n \"BYOActionGroup\": {\r\n \"value\": \"[[parameters('BYOActionGroup')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#113": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_activitylog_ServiceHealth_Maintenance\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Service Health Maintenance Alert\",\r\n \"description\": \"Policy to Deploy Service Health Maintenance Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.0\",\r\n \"category\": \"Monitoring\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"_deployed_by_amba\": true\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"disabled\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Monitoring disabled\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"ALZMonitorActionGroupEmail\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Action Group Email Addresses\",\r\n \"description\": \"Email addresses to send alerts to\"\r\n },\r\n \"defaultValue\": \"\"\r\n },\r\n \"BYOActionGroup\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Customer defined Action Group Resource ID\",\r\n \"description\": \"The Resource ID of an existing Action Group already deployed by the customer in his environment\"\r\n },\r\n \"defaultValue\": \"\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Resources/subscriptions\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/activityLogAlerts\",\r\n \"existenceScope\": \"resourcegroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"anyOf\": [\r\n {\r\n \"allOf\": [\r\n {\r\n \"value\": \"[[empty(parameters('BYOActionGroup'))]\",\r\n \"equals\": true\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/actions.actionGroups[*].actionGroupId\",\r\n \"contains\": \"ag-AMBA-SH-\"\r\n }\r\n ]\r\n },\r\n {\r\n \"allOf\": [\r\n {\r\n \"value\": \"[[empty(parameters('BYOActionGroup'))]\",\r\n \"equals\": false\r\n },\r\n {\r\n \"count\": {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/actions.actionGroups[*]\",\r\n \"where\": {\r\n \"anyOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/actions.actionGroups[*].actionGroupId\",\r\n \"contains\": \"[[split(trim(parameters('BYOActionGroup')),',')[0]]\"\r\n }\r\n ]\r\n }\r\n },\r\n \"equals\": 1\r\n }\r\n ]\r\n }\r\n ]\r\n },\r\n {\r\n \"count\": {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*]\",\r\n \"where\": {\r\n \"anyOf\": [\r\n {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].field\",\r\n \"equals\": \"category\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].equals\",\r\n \"equals\": \"ServiceHealth\"\r\n }\r\n ]\r\n },\r\n {\r\n \"allOf\": [\r\n {\r\n \"field\": \"microsoft.insights/activityLogAlerts/condition.allOf[*].field\",\r\n \"equals\": \"properties.incidentType\"\r\n },\r\n {\r\n \"field\": \"microsoft.insights/activityLogAlerts/condition.allOf[*].equals\",\r\n \"equals\": \"Maintenance\"\r\n }\r\n ]\r\n }\r\n ]\r\n }\r\n },\r\n \"equals\": 2\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"ALZMonitorActionGroupEmail\": {\r\n \"type\": \"string\"\r\n },\r\n \"BYOActionGroup\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {\r\n \"varBYOActionGroups\": \"[[split(parameters('BYOActionGroup'), ',')]\",\r\n \"copy\": [\r\n {\r\n \"name\": \"varActionGroupIds\",\r\n \"count\": \"[[length(variables('varBYOActionGroups'))]\",\r\n \"mode\": \"serial\",\r\n \"input\": {\r\n \"actionGroupId\": \"[[trim(variables('varBYOActionGroups')[copyIndex('varActionGroupIds')])]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"ServiceHealthMaintenance\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[resourceId('Microsoft.Resources/resourceGroups', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"ALZMonitorActionGroupEmail\": {\r\n \"type\": \"string\"\r\n },\r\n \"BYOActionGroup\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"condition\": \"[[empty(parameters('BYOActionGroup'))]\",\r\n \"type\": \"microsoft.insights/activityLogAlerts\",\r\n \"apiVersion\": \"2020-10-01\",\r\n \"name\": \"ServiceHealthPlannedMaintenance\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"actions\": {\r\n \"actionGroups\": [\r\n {\r\n \"actionGroupId\": \"[[concat(subscription().Id, '/resourceGroups/', parameters('alertResourceGroupName'), '/providers/microsoft.insights/actionGroups/', 'ag-AMBA-SH-', subscription().displayName, '-001')]\"\r\n }\r\n ]\r\n },\r\n \"description\": \"Service Health Planned Maintenance Alert\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().id]\"\r\n ],\r\n \"condition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"category\",\r\n \"equals\": \"ServiceHealth\"\r\n },\r\n {\r\n \"field\": \"properties.incidentType\",\r\n \"equals\": \"Maintenance\"\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n },\r\n {\r\n \"condition\": \"[[not(empty(parameters('BYOActionGroup')))]\",\r\n \"type\": \"microsoft.insights/activityLogAlerts\",\r\n \"apiVersion\": \"2020-10-01\",\r\n \"name\": \"ServiceHealthPlannedMaintenance\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"actions\": {\r\n \"actionGroups\": \"[[variables('varActionGroupIds')]\"\r\n },\r\n \"description\": \"Service Health Planned Maintenance Alert\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().id]\"\r\n ],\r\n \"condition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"category\",\r\n \"equals\": \"ServiceHealth\"\r\n },\r\n {\r\n \"field\": \"properties.incidentType\",\r\n \"equals\": \"Maintenance\"\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"ALZMonitorActionGroupEmail\": {\r\n \"value\": \"[[parameters('ALZMonitorActionGroupEmail')]\"\r\n },\r\n \"BYOActionGroup\": {\r\n \"value\": \"[[parameters('BYOActionGroup')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"ALZMonitorActionGroupEmail\": {\r\n \"value\": \"[[parameters('ALZMonitorActionGroupEmail')]\"\r\n },\r\n \"BYOActionGroup\": {\r\n \"value\": \"[[parameters('BYOActionGroup')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#114": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_activitylog_ServiceHealth_SecurityAdvisory\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Service Health Security Advisory Alert\",\r\n \"description\": \"Policy to Deploy Service Health Security Advisory Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.0\",\r\n \"category\": \"Monitoring\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"rg-amba-monitoring-001\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"_deployed_by_amba\": true\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"disabled\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Monitoring disabled\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n },\r\n \"ALZMonitorActionGroupEmail\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Action Group Email Addresses\",\r\n \"description\": \"Email addresses to send alerts to\"\r\n },\r\n \"defaultValue\": \"\"\r\n },\r\n \"BYOActionGroup\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Customer defined Action Group Resource ID\",\r\n \"description\": \"The Resource ID of an existing Action Group already deployed by the customer in his environment\"\r\n },\r\n \"defaultValue\": \"\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Resources/subscriptions\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/activityLogAlerts\",\r\n \"existenceScope\": \"resourcegroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"anyOf\": [\r\n {\r\n \"allOf\": [\r\n {\r\n \"value\": \"[[empty(parameters('BYOActionGroup'))]\",\r\n \"equals\": true\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/actions.actionGroups[*].actionGroupId\",\r\n \"contains\": \"ag-AMBA-SH-\"\r\n }\r\n ]\r\n },\r\n {\r\n \"allOf\": [\r\n {\r\n \"value\": \"[[empty(parameters('BYOActionGroup'))]\",\r\n \"equals\": false\r\n },\r\n {\r\n \"count\": {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/actions.actionGroups[*]\",\r\n \"where\": {\r\n \"anyOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/actions.actionGroups[*].actionGroupId\",\r\n \"contains\": \"[[split(trim(parameters('BYOActionGroup')),',')[0]]\"\r\n }\r\n ]\r\n }\r\n },\r\n \"equals\": 1\r\n }\r\n ]\r\n }\r\n ]\r\n },\r\n {\r\n \"count\": {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*]\",\r\n \"where\": {\r\n \"anyOf\": [\r\n {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].field\",\r\n \"equals\": \"category\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].equals\",\r\n \"equals\": \"ServiceHealth\"\r\n }\r\n ]\r\n },\r\n {\r\n \"allOf\": [\r\n {\r\n \"field\": \"microsoft.insights/activityLogAlerts/condition.allOf[*].field\",\r\n \"equals\": \"properties.incidentType\"\r\n },\r\n {\r\n \"field\": \"microsoft.insights/activityLogAlerts/condition.allOf[*].equals\",\r\n \"equals\": \"Security\"\r\n }\r\n ]\r\n }\r\n ]\r\n }\r\n },\r\n \"equals\": 2\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"ALZMonitorActionGroupEmail\": {\r\n \"type\": \"string\"\r\n },\r\n \"BYOActionGroup\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {\r\n \"varBYOActionGroups\": \"[[split(parameters('BYOActionGroup'), ',')]\",\r\n \"copy\": [\r\n {\r\n \"name\": \"varActionGroupIds\",\r\n \"count\": \"[[length(variables('varBYOActionGroups'))]\",\r\n \"mode\": \"serial\",\r\n \"input\": {\r\n \"actionGroupId\": \"[[trim(variables('varBYOActionGroups')[copyIndex('varActionGroupIds')])]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"ServiceSecurityIncident\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[resourceId('Microsoft.Resources/resourceGroups', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"ALZMonitorActionGroupEmail\": {\r\n \"type\": \"string\"\r\n },\r\n \"BYOActionGroup\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"condition\": \"[[empty(parameters('BYOActionGroup'))]\",\r\n \"type\": \"microsoft.insights/activityLogAlerts\",\r\n \"apiVersion\": \"2020-10-01\",\r\n \"name\": \"ServiceHealthSecurityIncident\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"actions\": {\r\n \"actionGroups\": [\r\n {\r\n \"actionGroupId\": \"[[concat(subscription().Id, '/resourceGroups/', parameters('alertResourceGroupName'), '/providers/microsoft.insights/actionGroups/', 'ag-AMBA-SH-', subscription().displayName, '-001')]\"\r\n }\r\n ]\r\n },\r\n \"description\": \"Service Health Security Alert\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().id]\"\r\n ],\r\n \"condition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"category\",\r\n \"equals\": \"ServiceHealth\"\r\n },\r\n {\r\n \"field\": \"properties.incidentType\",\r\n \"equals\": \"Security\"\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n },\r\n {\r\n \"condition\": \"[[not(empty(parameters('BYOActionGroup')))]\",\r\n \"type\": \"microsoft.insights/activityLogAlerts\",\r\n \"apiVersion\": \"2020-10-01\",\r\n \"name\": \"ServiceHealthSecurityIncident\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"actions\": {\r\n \"actionGroups\": \"[[variables('varActionGroupIds')]\"\r\n },\r\n \"description\": \"Service Health Security Alert\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().id]\"\r\n ],\r\n \"condition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"category\",\r\n \"equals\": \"ServiceHealth\"\r\n },\r\n {\r\n \"field\": \"properties.incidentType\",\r\n \"equals\": \"Security\"\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"ALZMonitorActionGroupEmail\": {\r\n \"value\": \"[[parameters('ALZMonitorActionGroupEmail')]\"\r\n },\r\n \"BYOActionGroup\": {\r\n \"value\": \"[[parameters('BYOActionGroup')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"ALZMonitorActionGroupEmail\": {\r\n \"value\": \"[[parameters('ALZMonitorActionGroupEmail')]\"\r\n },\r\n \"BYOActionGroup\": {\r\n \"value\": \"[[parameters('BYOActionGroup')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#115": { - "type": "Microsoft.Authorization/policySetDefinitions", - "apiVersion": "2021-06-01", - "name": "Alerting-Connectivity", - "properties": { - "displayName": "Deploy Azure Monitor Baseline Alerts for Connectivity", - "description": "Initiative to deploy AMBA alerts relevant to the ALZ Connectivity management group", - "metadata": { - "version": "1.1.1", - "category": "Monitoring", - "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", - "alzCloudEnvironments": [ - "AzureCloud" - ], - "_deployed_by_amba": true - }, - "parameters": { - "ALZMonitorResourceGroupName": { - "type": "String", - "defaultValue": "ALZ-Monitoring-RG", - "metadata": { - "displayName": "ALZ Monitor Resource Group Name", - "description": "Name of the resource group where the ALZ Monitor resources will be deployed" - } - }, - "ALZMonitorResourceGroupTags": { - "type": "Object", - "defaultValue": { - "_deployed_by_alz_monitor": true - }, - "metadata": { - "displayName": "ALZ Monitor Resource Group Tags", - "description": "Tags to be applied to the resource group where the ALZ Monitor resources will be deployed" - } - }, - "ALZMonitorResourceGroupLocation": { - "type": "String", - "defaultValue": "centralus", - "metadata": { - "displayName": "ALZ Monitor Resource Group Location", - "description": "Location of the resource group where the ALZ Monitor resources will be deployed" - } - }, - "ERCIRQoSDropBitsinPerSecAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "ERC IRQoS Drop Bits in Per Sec Alert Severity", - "description": "Severity of the alert" - } - }, - "ERCIRQoSDropBitsinPerSecWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "ERC IRQoS Drop Bits in Per Sec Window Size", - "description": "Window size for the alert" - } - }, - "ERCIRQoSDropBitsinPerSecEvaluationFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "ERC IRQoS Drop Bits in Per Sec Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "ERCIRQoSDropBitsinPerSecPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "ERC IRQoS Drop Bits in Per Sec Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "ERCIRQoSDropBitsinPerSecAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "ERC IRQoS Drop Bits in Per Sec Alert State", - "description": "Alert state for the alert" - } - }, - "ERCIRQoSDropBitsoutPerSecAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "ERC IRQoS Drop Bits out Per Sec Alert Severity", - "description": "Severity of the alert" - } - }, - "ERCIRQoSDropBitsoutPerSecWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "ERC IRQoS Drop Bits out Per Sec Window Size", - "description": "Window size for the alert" - } - }, - "ERCIRQoSDropBitsoutPerSecEvaluationFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "ERC IRQoS Drop Bits out Per Sec Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "ERCIRQoSDropBitsoutPerSecPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "ERC IRQoS Drop Bits out Per Sec Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "ERCIRQoSDropBitsoutPerSecAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "ERC IRQoS Drop Bits out Per Sec Alert State", - "description": "Alert state for the alert" - } - }, - "VPNGwBGPPeerStatusAlertSeverity": { - "type": "String", - "defaultValue": "3", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "VPN Gw BGP Peer Status Alert Severity", - "description": "Severity of the alert" - } - }, - "VPNGwBGPPeerStatusWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "VPN Gw BGP Peer Status Window Size", - "description": "Window size for the alert" - } - }, - "VPNGwBGPPeerStatusEvaluationFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "VPN Gw BGP Peer Status Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "VPNGwBGPPeerStatusPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "VPN Gw BGP Peer Status Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "VPNGwBGPPeerStatusAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "VPN Gw BGP Peer Status Alert State", - "description": "Alert state for the alert" - } - }, - "VPNGwBGPPeerStatusThreshold": { - "type": "string", - "defaultValue": "1", - "metadata": { - "displayName": "VPN Gw BGP Peer Status Threshold", - "description": "Threshold for the alert" - } - }, - "VnetGwERCpuUtilAlertSeverity": { - "type": "String", - "defaultValue": "3", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "Vnet Gw ER Cpu Util Alert Severity", - "description": "Severity of the alert" - } - }, - "VnetGwERCpuUtilWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "Vnet Gw ER Cpu Util Window Size", - "description": "Window size for the alert" - } - }, - "VnetGwERCpuUtilEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "Vnet Gw ER Cpu Util Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "VnetGwERCpuUtilPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "Vnet Gw ER Cpu Util Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "VnetGwERCpuUtilAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Vnet Gw ER Cpu Util Alert State", - "description": "Alert state for the alert" - } - }, - "VnetGwERCpuUtilThreshold": { - "type": "string", - "defaultValue": "80", - "metadata": { - "displayName": "Vnet Gw ER Cpu Util Threshold", - "description": "Threshold for the alert" - } - }, - "VnetGwTunnelBWAlertSeverity": { - "type": "String", - "defaultValue": "0", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "Vnet Gw Tunnel BW Alert Severity", - "description": "Severity of the alert" - } - }, - "VnetGwTunnelBWWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "Vnet Gw Tunnel BW Window Size", - "description": "Window size for the alert" - } - }, - "VnetGwTunnelBWEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "Vnet Gw Tunnel BW Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "VnetGwTunnelBWPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "Vnet Gw Tunnel BW Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "VnetGwTunnelBWAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Vnet Gw Tunnel BW Alert State", - "description": "Alert state for the alert" - } - }, - "VnetGwTunnelBWThreshold": { - "type": "string", - "defaultValue": "1", - "metadata": { - "displayName": "Vnet Gw Tunnel BW Threshold", - "description": "Threshold for the alert" - } - }, - "VnetGwTunnelEgressAlertSeverity": { - "type": "String", - "defaultValue": "0", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "Vnet Gw Tunnel Egress Alert Severity", - "description": "Severity of the alert" - } - }, - "VnetGwTunnelEgressWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "Vnet Gw Tunnel Egress Window Size", - "description": "Window size for the alert" - } - }, - "VnetGwTunnelEgressEvaluationFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "Vnet Gw Tunnel Egress Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "VnetGwTunnelEgressPolicyEffect": { - "type": "string", - "defaultValue": "disabled", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "Vnet Gw Tunnel Egress Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "VnetGwTunnelEgressAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Vnet Gw Tunnel Egress Alert State", - "description": "Alert state for the alert" - } - }, - "VnetGwTunnelEgressThreshold": { - "type": "string", - "defaultValue": "1", - "metadata": { - "displayName": "Vnet Gw Tunnel Egress Threshold", - "description": "Threshold for the alert" - } - }, - "VnetGwTunnelIngressAlertSeverity": { - "type": "String", - "defaultValue": "0", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "Vnet Gw Tunnel Ingress Alert Severity", - "description": "Severity of the alert" - } - }, - "VnetGwTunnelIngressWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "Vnet Gw Tunnel Ingress Window Size", - "description": "Window size for the alert" - } - }, - "VnetGwTunnelIngressEvaluationFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "Vnet Gw Tunnel Ingress Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "VnetGwTunnelIngressPolicyEffect": { - "type": "string", - "defaultValue": "disabled", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "Vnet Gw Tunnel Ingress Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "VnetGwTunnelIngressAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Vnet Gw Tunnel Ingress Alert State", - "description": "Alert state for the alert" - } - }, - "VnetGwTunnelIngressThreshold": { - "type": "string", - "defaultValue": "1", - "metadata": { - "displayName": "Vnet Gw Tunnel Ingress Threshold", - "description": "Threshold for the alert" - } - }, - "VPNGWBandWidthUtilAlertSeverity": { - "type": "String", - "defaultValue": "0", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "VPN GW Band Width Util Alert Severity", - "description": "Severity of the alert" - } - }, - "VPNGWBandWidthUtilWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "VPN GW Band Width Util Window Size", - "description": "Window size for the alert" - } - }, - "VPNGWBandWidthUtilEvaluationFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "VPN GW Band Width Util Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "VPNGWBandWidthUtilPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "VPN GW Band Width Util Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "VPNGWBandWidthUtilAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "VPN GW Band Width Util Alert State", - "description": "Alert state for the alert" - } - }, - "VPNGWBandWidthUtilThreshold": { - "type": "string", - "defaultValue": "1", - "metadata": { - "displayName": "VPN GW Band Width Util Threshold", - "description": "Threshold for the alert" - } - }, - "VPNGWEgressAlertSeverity": { - "type": "String", - "defaultValue": "0", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "VPN GW Egress Alert Severity", - "description": "Severity of the alert" - } - }, - "VPNGWEgressWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "VPN GW Egress Window Size", - "description": "Window size for the alert" - } - }, - "VPNGWEgressEvaluationFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "VPN GW Egress Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "VPNGWEgressPolicyEffect": { - "type": "string", - "defaultValue": "disabled", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "VPN GW Egress Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "VPNGWEgressAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "VPN GW Egress Alert State", - "description": "Alert state for the alert" - } - }, - "VPNGWEgressThreshold": { - "type": "string", - "defaultValue": "1", - "metadata": { - "displayName": "VPN GW Egress Threshold", - "description": "Threshold for the alert" - } - }, - "VPNGWTunnelEgressPacketDropCountAlertSeverity": { - "type": "String", - "defaultValue": "3", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "VPN GW Tunnel Egress Packet Drop Count Alert Severity", - "description": "Severity of the alert" - } - }, - "VPNGWTunnelEgressPacketDropCountWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "VPN GW Tunnel Egress Packet Drop Count Window Size", - "description": "Window size for the alert" - } - }, - "VPNGWTunnelEgressPacketDropCountFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "VPN GW Tunnel Egress Packet Drop Count Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "VPNGWTunnelEgressPacketDropCountPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "VPN GW Tunnel Egress Packet Drop Count Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "VPNGWTunnelEgressPacketDropCountAlertState": { - "type": "string", - "defaultValue": "true" - }, - "VPNGWTunnelEgressPacketDropMismatchAlertSeverity": { - "type": "String", - "defaultValue": "3", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "VPN GW Tunnel Egress Packet Drop Mismatch Alert Severity", - "description": "Severity of the alert" - } - }, - "VPNGWTunnelEgressPacketDropMismatchWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "VPN GW Tunnel Egress Packet Drop Mismatch Window Size", - "description": "Window size for the alert" - } - }, - "VPNGWTunnelEgressPacketDropMismatchFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "VPN GW Tunnel Egress Packet Drop Mismatch Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "VPNGWTunnelEgressPacketDropMismatchPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "VPN GW Tunnel Egress Packet Drop Mismatch Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "VPNGWTunnelEgressPacketDropMismatchAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "VPN GW Tunnel Egress Packet Drop Mismatch Alert State", - "description": "Alert state for the alert" - } - }, - "VPNGWIngressAlertSeverity": { - "type": "string", - "defaultValue": "0", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "VPN GW Ingress Alert Severity", - "description": "Severity of the alert" - } - }, - "VPNGWIngressWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "VPN GW Ingress Window Size", - "description": "Window size for the alert" - } - }, - "VPNGWIngressEvaluationFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "VPN GW Ingress Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "VPNGWIngressPolicyEffect": { - "type": "string", - "defaultValue": "disabled", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "VPN GW Ingress Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "VPNGWIngressAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "VPN GW Ingress Alert State", - "description": "Alert state for the alert" - } - }, - "VPNGWIngressThreshold": { - "type": "string", - "defaultValue": "1", - "metadata": { - "displayName": "VPN GW Ingress Threshold", - "description": "Threshold for the alert" - } - }, - "VPNGWIngressAutoMitigate": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "VPN GW Ingress Auto Mitigate", - "description": "Auto Mitigate for the alert" - } - }, - "VPNGWTunnelIngressPacketDropCountAlertSeverity": { - "type": "String", - "defaultValue": "3", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "VPN GW Tunnel Ingress Packet Drop Count Alert Severity", - "description": "Severity of the alert" - } - }, - "VPNGWTunnelIngressPacketDropCountWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "VPN GW Tunnel Ingress Packet Drop Count Window Size", - "description": "Window size for the alert" - } - }, - "VPNGWTunnelIngressPacketDropCountFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "VPN GW Tunnel Ingress Packet Drop Count Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "VPNGWTunnelIngressPacketDropCountPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "VPN GW Tunnel Ingress Packet Drop Count Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "VPNGWTunnelIngressPacketDropCountAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "VPN GW Tunnel Ingress Packet Drop Count Alert State", - "description": "Alert state for the alert" - } - }, - "VPNGWTunnelIngressPacketDropMismatchAlertSeverity": { - "type": "String", - "defaultValue": "3", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "VPN GW Tunnel Ingress Packet Drop Mismatch Alert Severity", - "description": "Severity of the alert" - } - }, - "VPNGWTunnelIngressPacketDropMismatchWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "VPN GW Tunnel Ingress Packet Drop Mismatch Window Size", - "description": "Window size for the alert" - } - }, - "VPNGWTunnelIngressPacketDropMismatchFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "VPN GW Tunnel Ingress Packet Drop Mismatch Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "VPNGWTunnelIngressPacketDropMismatchPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "VPN GW Tunnel Ingress Packet Drop Mismatch Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "VPNGWTunnelIngressPacketDropMismatchAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "VPN GW Tunnel Ingress Packet Drop Mismatch Alert State", - "description": "Alert state for the alert" - } - }, - "PDNSZCapacityUtilAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "PDNSZ Capacity Util Alert Severity", - "description": "Severity of the alert" - } - }, - "PDNSZCapacityUtilWindowSize": { - "type": "string", - "defaultValue": "PT1H", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "PDNSZ Capacity Util Window Size", - "description": "Window size for the alert" - } - }, - "PDNSZCapacityUtilEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1H", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "PDNSZ Capacity Util Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "PDNSZCapacityUtilPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "PDNSZ Capacity Util Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "PDNSZCapacityUtilAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "PDNSZ Capacity Util Alert State", - "description": "Alert state for the alert" - } - }, - "PDNSZCapacityUtilThreshold": { - "type": "string", - "defaultValue": "80", - "metadata": { - "displayName": "PDNSZ Capacity Util Threshold", - "description": "Threshold for the alert" - } - }, - "PDNSZQueryVolumeAlertSeverity": { - "type": "String", - "defaultValue": "4", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "PDNSZ Query Volume Alert Severity", - "description": "Severity of the alert" - } - }, - "PDNSZQueryVolumeWindowSize": { - "type": "string", - "defaultValue": "PT1H", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "PDNSZ Query Volume Window Size", - "description": "Window size for the alert" - } - }, - "PDNSZQueryVolumeEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1H", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "PDNSZ Query Volume Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "PDNSZQueryVolumePolicyEffect": { - "type": "string", - "defaultValue": "disabled", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "PDNSZ Query Volume Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "PDNSZQueryVolumeAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "PDNSZ Query Volume Alert State", - "description": "Alert state for the alert" - } - }, - "PDNSZQueryVolumeThreshold": { - "type": "string", - "defaultValue": "500", - "metadata": { - "displayName": "PDNSZ Query Volume Threshold", - "description": "Threshold for the alert" - } - }, - "PDNSZRecordSetCapacityAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "PDNSZ Record Set Capacity Alert Severity", - "description": "Severity of the alert" - } - }, - "PDNSZRecordSetCapacityWindowSize": { - "type": "string", - "defaultValue": "PT1H", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "PDNSZ Record Set Capacity Window Size", - "description": "Window size for the alert" - } - }, - "PDNSZRecordSetCapacityEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1H", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "PDNSZ Record Set Capacity Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "PDNSZRecordSetCapacityPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "PDNSZ Record Set Capacity Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "PDNSZRecordSetCapacityAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "PDNSZ Record Set Capacity Alert State", - "description": "Alert state for the alert" - } - }, - "PDNSZRecordSetCapacityThreshold": { - "type": "string", - "defaultValue": "80", - "metadata": { - "displayName": "PDNSZ Record Set Capacity Threshold", - "description": "Threshold for the alert" - } - }, - "PDNSZRegistrationCapacityUtilAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "PDNSZ Registration Capacity Util Alert Severity", - "description": "Severity of the alert" - } - }, - "PDNSZRegistrationCapacityUtilWindowSize": { - "type": "string", - "defaultValue": "PT1H", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "PDNSZ Registration Capacity Util Window Size", - "description": "Window size for the alert" - } - }, - "PDNSZRegistrationCapacityUtilEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1H", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "PDNSZ Registration Capacity Util Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "PDNSZRegistrationCapacityUtilPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "PDNSZ Registration Capacity Util Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "PDNSZRegistrationCapacityUtilAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "PDNSZ Registration Capacity Util Alert State", - "description": "Alert state for the alert" - } - }, - "PDNSZRegistrationCapacityUtilThreshold": { - "type": "string", - "defaultValue": "80", - "metadata": { - "displayName": "PDNSZ Registration Capacity Util Threshold", - "description": "Threshold for the alert" - } - }, - "PIPDDoSAttackAlertSeverity": { - "type": "String", - "defaultValue": "1", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "PIP DDoS Attack Alert Severity", - "description": "Severity of the alert" - } - }, - "PIPDDoSAttackWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "PIP DDoS Attack Window Size", - "description": "Window size for the alert" - } - }, - "PIPDDoSAttackEvaluationFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "PIP DDoS Attack Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "PIPDDoSAttackPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "PIP DDoS Attack Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "PIPDDoSAttackAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "PIP DDoS Attack Alert State", - "description": "Alert state for the alert" - } - }, - "PIPDDoSAttackThreshold": { - "type": "string", - "defaultValue": "0", - "metadata": { - "displayName": "PIP DDoS Attack Threshold", - "description": "Threshold for the alert" - } - }, - "PIPPacketsInDDoSAlertSeverity": { - "type": "String", - "defaultValue": "4", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "PIP Packets In DDoS Alert Severity", - "description": "Severity of the alert" - } - }, - "PIPPacketsInDDoSWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "PIP Packets In DDoS Window Size", - "description": "Window size for the alert" - } - }, - "PIPPacketsInDDoSEvaluationFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "PIP Packets In DDoS Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "PIPPacketsInDDoSPolicyEffect": { - "type": "string", - "defaultValue": "disabled", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "PIP Packets In DDoS Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "PIPPacketsInDDoSAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "PIP Packets In DDoS Alert State", - "description": "Alert state for the alert" - } - }, - "PIPPacketsInDDoSThreshold": { - "type": "string", - "defaultValue": "40000", - "metadata": { - "displayName": "PIP Packets In DDoS Threshold", - "description": "Threshold for the alert" - } - }, - "PIPVIPAvailabilityAlertSeverity": { - "type": "String", - "defaultValue": "1", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "PIP VIP Availability Alert Severity", - "description": "Severity of the alert" - } - }, - "PIPVIPAvailabilityWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "PIP VIP Availability Window Size", - "description": "Window size for the alert" - } - }, - "PIPVIPAvailabilityEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "PIP VIP Availability Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "PIPVIPAvailabilityPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "PIP VIP Availability Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "PIPVIPAvailabilityAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "PIP VIP Availability Alert State", - "description": "Alert state for the alert" - } - }, - "PIPVIPAvailabilityThreshold": { - "type": "string", - "defaultValue": "1", - "metadata": { - "displayName": "PIP VIP Availability Threshold", - "description": "Threshold for the alert" - } - }, - "PIPBytesInDDoSAlertSeverity": { - "type": "String", - "defaultValue": "4", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "PIP Bytes In DDoS Alert Severity", - "description": "Severity of the alert" - } - }, - "PIPBytesInDDoSWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "PIP Bytes In DDoS Window Size", - "description": "Window size for the alert" - } - }, - "PIPBytesInDDoSEvaluationFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "PIP Bytes In DDoS Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "PIPBytesInDDoSPolicyEffect": { - "type": "string", - "defaultValue": "disabled", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "PIP Bytes In DDoS Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "PIPBytesInDDoSAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "PIP Bytes In DDoS Alert State", - "description": "Alert state for the alert" - } - }, - "PIPBytesInDDoSThreshold": { - "type": "string", - "defaultValue": "8000000", - "metadata": { - "displayName": "PIP Bytes In DDoS Threshold", - "description": "Threshold for the alert" - } - }, - "ERGwExpressRouteBitsInAlertSeverity": { - "type": "String", - "defaultValue": "0", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "ER Gw Express Route Bits In Alert Severity", - "description": "Severity of the alert" - } - }, - "ERGwExpressRouteBitsInWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "ER Gw Express Route Bits In Window Size", - "description": "Window size for the alert" - } - }, - "ERGwExpressRouteBitsInEvaluationFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "ER Gw Express Route Bits In Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "ERGwExpressRouteBitsInPolicyEffect": { - "type": "string", - "defaultValue": "disabled", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "ER Gw Express Route Bits In Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "ERGwExpressRouteBitsInAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "ER Gw Express Route Bits In Alert State", - "description": "Alert state for the alert" - } - }, - "ERGwExpressRouteBitsInThreshold": { - "type": "string", - "defaultValue": "1", - "metadata": { - "displayName": "ER Gw Express Route Bits In Threshold", - "description": "Threshold for the alert" - } - }, - "ERGwExpressRouteBitsOutAlertSeverity": { - "type": "String", - "defaultValue": "0", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "ER Gw Express Route Bits Out Alert Severity", - "description": "Severity of the alert" - } - }, - "ERGwExpressRouteBitsOutWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "ER Gw Express Route Bits Out Window Size", - "description": "Window size for the alert" - } - }, - "ERGwExpressRouteBitsOutEvaluationFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "ER Gw Express Route Bits Out Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "ERGwExpressRouteBitsOutPolicyEffect": { - "type": "string", - "defaultValue": "disabled", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "ER Gw Express Route Bits Out Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "ERGwExpressRouteBitsOutAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "ER Gw Express Route Bits Out Alert State", - "description": "Alert state for the alert" - } - }, - "ERGwExpressRouteBitsOutThreshold": { - "type": "string", - "defaultValue": "1", - "metadata": { - "displayName": "ER Gw Express Route Bits Out Threshold", - "description": "Threshold for the alert" - } - }, - "ERGwExpressRouteCpuUtilAlertSeverity": { - "type": "String", - "defaultValue": "1", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "ER Gw Express Route Cpu Util Alert Severity", - "description": "Severity of the alert" - } - }, - "ERGwExpressRouteCpuUtilWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "ER Gw Express Route Cpu Util Window Size", - "description": "Window size for the alert" - } - }, - "ERGwExpressRouteCpuUtilEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "ER Gw Express Route Cpu Util Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "ERGwExpressRouteCpuUtilPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "ER Gw Express Route Cpu Util Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "ERGwExpressRouteCpuUtilAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "ER Gw Express Route Cpu Util Alert State", - "description": "Alert state for the alert" - } - }, - "ERGwExpressRouteCpuUtilThreshold": { - "type": "string", - "defaultValue": "80", - "metadata": { - "displayName": "ER Gw Express Route Cpu Util Threshold", - "description": "Threshold for the alert" - } - }, - "VNETDDOSAttackAlertSeverity": { - "type": "String", - "defaultValue": "1", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "VNET DDoS Attack Alert Severity", - "description": "Severity of the alert" - } - }, - "VNETDDOSAttackWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "VNET DDoS Attack Window Size", - "description": "Window size for the alert" - } - }, - "VNETDDOSAttackEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "VNET DDoS Attack Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "VNETDDOSAttackPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "VNET DDoS Attack Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "VNETDDOSAttackAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "VNET DDoS Attack Alert State", - "description": "Alert state for the alert" - } - }, - "VNETDDOSAttackThreshold": { - "type": "string", - "defaultValue": "1", - "metadata": { - "displayName": "VNET DDoS Attack Threshold", - "description": "Threshold for the alert" - } - }, - "VnetGwTunnelEgressPacketDropCountAlertSeverity": { - "type": "String", - "defaultValue": "1", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "Vnet Gw Tunnel Egress Packet Drop Count Alert Severity", - "description": "Severity of the alert" - } - }, - "VnetGwTunnelEgressPacketDropCountWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "Vnet Gw Tunnel Egress Packet Drop Count Window Size", - "description": "Window size for the alert" - } - }, - "VnetGwTunnelEgressPacketDropCountEvaluationFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "Vnet Gw Tunnel Egress Packet Drop Count Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "VnetGwTunnelEgressPacketDropCountPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "Vnet Gw Tunnel Egress Packet Drop Count Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "VnetGwTunnelEgressPacketDropCountAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Vnet Gw Tunnel Egress Packet Drop Count Alert State", - "description": "Alert state for the alert" - } - }, - "VnetGwTunnelEgressPacketDropMismatchAlertSeverity": { - "type": "String", - "defaultValue": "3", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "Vnet Gw Tunnel Egress Packet Drop Mismatch Alert Severity", - "description": "Severity of the alert" - } - }, - "VnetGwTunnelEgressPacketDropMismatchWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "Vnet Gw Tunnel Egress Packet Drop Mismatch Window Size", - "description": "Window size for the alert" - } - }, - "VnetGwTunnelEgressPacketDropMismatchEvaluationFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "Vnet Gw Tunnel Egress Packet Drop Mismatch Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "VnetGwTunnelEgressPacketDropMismatchPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "Vnet Gw Tunnel Egress Packet Drop Mismatch Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "VnetGwTunnelEgressPacketDropMismatchAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Vnet Gw Tunnel Egress Packet Drop Mismatch Alert State", - "description": "Alert state for the alert" - } - }, - "VnetGwExpressRouteBitsPerSecondAlertSeverity": { - "type": "String", - "defaultValue": "0", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "Vnet Gw Express Route Bits Per Second Alert Severity", - "description": "Severity of the alert" - } - }, - "VnetGwExpressRouteBitsPerSecondWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "Vnet Gw Express Route Bits Per Second Window Size", - "description": "Window size for the alert" - } - }, - "VnetGwExpressRouteBitsPerSecondEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "Vnet Gw Express Route Bits Per Second Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "VnetGwExpressRouteBitsPerSecondPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "Vnet Gw Express Route Bits Per Second Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "VnetGwExpressRouteBitsPerSecondAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Vnet Gw Express Route Bits Per Second Alert State", - "description": "Alert state for the alert" - } - }, - "VnetGwExpressRouteBitsPerSecondThreshold": { - "type": "string", - "defaultValue": "1", - "metadata": { - "displayName": "Vnet Gw Express Route Bits Per Second Threshold", - "description": "Threshold for the alert" - } - }, - "VnetGwTunnelIngressPacketDropMismatchAlertSeverity": { - "type": "String", - "defaultValue": "3", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "Vnet Gw Tunnel Ingress Packet Drop Mismatch Alert Severity", - "description": "Severity of the alert" - } - }, - "VnetGwTunnelIngressPacketDropMismatchWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "Vnet Gw Tunnel Ingress Packet Drop Mismatch Window Size", - "description": "Window size for the alert" - } - }, - "VnetGwTunnelIngressPacketDropMismatchEvaluationFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "Vnet Gw Tunnel Ingress Packet Drop Mismatch Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "VnetGwTunnelIngressPacketDropMismatchPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "Vnet Gw Tunnel Ingress Packet Drop Mismatch Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "VnetGwTunnelIngressPacketDropMismatchAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Vnet Gw Tunnel Ingress Packet Drop Mismatch Alert State", - "description": "Alert state for the alert" - } - }, - "VnetGwTunnelIngressPacketDropCountAlertSeverity": { - "type": "String", - "defaultValue": "3", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "Vnet Gw Tunnel Ingress Packet Drop Count Alert Severity", - "description": "Severity of the alert" - } - }, - "VnetGwTunnelIngressPacketDropCountWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "Vnet Gw Tunnel Ingress Packet Drop Count Window Size", - "description": "Window size for the alert" - } - }, - "VnetGwTunnelIngressPacketDropCountEvaluationFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "Vnet Gw Tunnel Ingress Packet Drop Count Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "VnetGwTunnelIngressPacketDropCountPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "Vnet Gw Tunnel Ingress Packet Drop Count Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "VnetGwTunnelIngressPacketDropCountAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Vnet Gw Tunnel Ingress Packet Drop Count Alert State", - "description": "Alert state for the alert" - } - }, - "ERCIRBgpAvailabilityAlertSeverity": { - "type": "String", - "defaultValue": "0", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "ERCIR Bgp Availability Alert Severity", - "description": "Severity of the alert" - } - }, - "ERCIRBgpAvailabilityWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "ERCIR Bgp Availability Window Size", - "description": "Window size for the alert" - } - }, - "ERCIRBgpAvailabilityEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "ERCIR Bgp Availability Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "ERCIRBgpAvailabilityPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "ERCIR Bgp Availability Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "ERCIRBgpAvailabilityAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "ERCIR Bgp Availability Alert State", - "description": "Alert state for the alert" - } - }, - "ERCIRBgpAvailabilityThreshold": { - "type": "string", - "defaultValue": "90", - "metadata": { - "displayName": "ERCIR Bgp Availability Threshold", - "description": "Threshold for the alert" - } - }, - "ERCIRArpAvailabilityAlertSeverity": { - "type": "String", - "defaultValue": "0", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "ERCIR Arp Availability Alert Severity", - "description": "Severity of the alert" - } - }, - "ERCIRArpAvailabilityWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "ERCIR Arp Availability Window Size", - "description": "Window size for the alert" - } - }, - "ERCIRArpAvailabilityFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "ERCIR Arp Availability Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "ERCIRArpAvailabilityPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "ERCIR ARP Availability Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "ERCIRArpAvailabilityAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "ERCIR Arp Availability Alert State", - "description": "Alert state for the alert" - } - }, - "ERCIRArpAvailabilityThreshold": { - "type": "string", - "defaultValue": "90", - "metadata": { - "displayName": "ERCIR Arp Availability Threshold", - "description": "Threshold for the alert" - } - }, - "AFWSNATPortUtilizationAlertSeverity": { - "type": "String", - "defaultValue": "1", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "AFW SNAT Port Utilization Alert Severity", - "description": "Severity of the alert" - } - }, - "AFWSNATPortUtilizationWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "AFW SNAT Port Utilization Window Size", - "description": "Window size for the alert" - } - }, - "AFWSNATPortUtilizationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "AFW SNAT Port Utilization Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "AFWSNATPortUtilizationPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "AFW SNAT Port Utilization Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "AFWSNATPortUtilizationAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "AFW SNAT Port Utilization Alert State", - "description": "Alert state for the alert" - } - }, - "AFWSNATPortUtilizationThreshold": { - "type": "string", - "defaultValue": "80", - "metadata": { - "displayName": "AFW SNAT Port Utilization Threshold", - "description": "Threshold for the alert" - } - }, - "FirewallHealthAlertSeverity": { - "type": "String", - "defaultValue": "0", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "Firewall Health Alert Severity", - "description": "Severity of the alert" - } - }, - "FirewallHealthWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "Firewall Health Window Size", - "description": "Window size for the alert" - } - }, - "FirewallHealthEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "Firewall Health Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "FirewallHealthPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "Firewall Health Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "FirewallHealthAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Firewall Health Alert State", - "description": "Alert state for the alert" - } - }, - "FirewallHealthThreshold": { - "type": "string", - "defaultValue": "90", - "metadata": { - "displayName": "Firewall Health Threshold", - "description": "Threshold for the alert" - } - }, - "activityFWDeleteAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Activity FW Delete Alert State", - "description": "Alert state for the alert" - } - }, - "activityNSGDeleteAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Activity NSG Delete Alert State", - "description": "Alert state for the alert" - } - }, - "activityUDRUpdateAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Activity UDR Update Alert State", - "description": "Alert state for the alert" - } - }, - "activityVPNGWDeleteAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Activity VPN GW Delete Alert State", - "description": "Alert state for the alert" - } - }, - "LBDatapathAvailabilityAlertSeverity": { - "type": "String", - "defaultValue": "0", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "LB Data path Availability Alert Severity", - "description": "Severity of the alert" - } - }, - "LBDatapathAvailabilityWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "LB Data path Availability Window Size", - "description": "Window size for the alert" - } - }, - "LBDatapathAvailabilityEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "LB Data path Availability Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "LBDatapathAvailabilityPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "LB Data path Availability Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "LBDatapathAvailabilityAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "LB Data path Availability Alert State", - "description": "Alert state for the alert" - } - }, - "LBGlobalBackendAvailabilityAlertSeverity": { - "type": "String", - "defaultValue": "0", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "LB Global Backend Availability Alert Severity", - "description": "Severity of the alert" - } - }, - "LBGlobalBackendAvailabilityWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "LB Global Backend Availability Window Size", - "description": "Window size for the alert" - } - }, - "LBGlobalBackendAvailabilityEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "LB Global Backend Availability Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "LBGlobalBackendAvailabilityPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "LB Global Backend Availability Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "LBGlobalBackendAvailabilityAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "LB Global Backend Availability Alert State", - "description": "Alert state for the alert" - } - }, - "LBHealthProbeStatusAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "LB Health Probe Status Alert Severity", - "description": "Severity of the alert" - } - }, - "LBHealthProbeStatusWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "LB Health Probe Status Window Size", - "description": "Window size for the alert" - } - }, - "LBHealthProbeStatusEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "LB Health Probe Status Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "LBHealthProbeStatusPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "LB Health Probe Status Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "LBHealthProbeStatusAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "LB Health Probe Status Alert State", - "description": "Alert state for the alert" - } - }, - "LBUsedSNATPortsAlertSeverity": { - "type": "String", - "defaultValue": "1", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "LB Used SNAT Ports Alert Severity", - "description": "Severity of the alert" - } - }, - "LBUsedSNATPortsWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "LB Used SNAT Ports Window Size", - "description": "Window size for the alert" - } - }, - "LBUsedSNATPortsEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "LB Used SNAT Ports Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "LBUsedSNATPortsPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "LB Used SNAT Ports Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "LBUsedSNATPortsAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "LB Used SNAT Ports Alert State", - "description": "Alert state for the alert" - } - }, - "ERPBitsInPerSecondAlertSeverity": { - "type": "String", - "defaultValue": "0", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "ERP Bits In Per Second Alert Severity", - "description": "Severity of the alert" - } - }, - "ERPBitsInPerSecondWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "ERP Bits In Per Second Window Size", - "description": "Window size for the alert" - } - }, - "ERPBitsInPerSecondEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "ERP Bits In Per Second Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "ERPBitsInPerSecondPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "ERP Bits In Per Second Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "ERPBitsInPerSecondAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "ERP Bits In Per Second Alert State", - "description": "Alert state for the alert" - } - }, - "ERPBitsOutPerSecondAlertSeverity": { - "type": "String", - "defaultValue": "0", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "ERP Bits Out Per Second Alert Severity", - "description": "Severity of the alert" - } - }, - "ERPBitsOutPerSecondWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "ERP Bits Out Per Second Window Size", - "description": "Window size for the alert" - } - }, - "ERPBitsOutPerSecondEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "ERP Bits Out Per Second Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "ERPBitsOutPerSecondPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "ERP Bits Out Per Second Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "ERPBitsOutPerSecondAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "ERP Bits Out Per Second Alert State", - "description": "Alert state for the alert" - } - }, - "ERPLineProtocolAlertSeverity": { - "type": "String", - "defaultValue": "0", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "ERP Line Protocol Alert Severity", - "description": "Severity of the alert" - } - }, - "ERPLineProtocolWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "ERP Line Protocol Window Size", - "description": "Window size for the alert" - } - }, - "ERPLineProtocolEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "ERP Line Protocol Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "ERPLineProtocolPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "ERP Line Protocol Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "ERPLineProtocolAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "ERP Line Protocol Alert State", - "description": "Alert state for the alert" - } - }, - "ERPRxLightLevelHighAlertSeverity": { - "type": "String", - "defaultValue": "1", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "ERP Rx Light Level High Alert Severity", - "description": "Severity of the alert" - } - }, - "ERPRxLightLevelHighWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "ERP Rx Light Level High Window Size", - "description": "Window size for the alert" - } - }, - "ERPRxLightLevelHighEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "ERP Rx Light Level High Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "ERPRxLightLevelHighPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "ERP Rx Light Level High Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "ERPRxLightLevelHighAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "ERP Rx Light Level High Alert State", - "description": "Alert state for the alert" - } - }, - "ERPRxLightLevelLowAlertSeverity": { - "type": "String", - "defaultValue": "1", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "ERP Rx Light Level Low Alert Severity", - "description": "Severity of the alert" - } - }, - "ERPRxLightLevelLowWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "ERP Rx Light Level Low Window Size", - "description": "Window size for the alert" - } - }, - "ERPRxLightLevelLowEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "ERP Rx Light Level Low Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "ERPRxLightLevelLowPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "ERP Rx Light Level Low Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "ERPRxLightLevelLowAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "ERP Rx Light Level Low Alert State", - "description": "Alert state for the alert" - } - }, - "ERPTxLightLevelHighAlertSeverity": { - "type": "String", - "defaultValue": "1", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "ERP Tx Light Level High Alert Severity", - "description": "Severity of the alert" - } - }, - "ERPTxLightLevelHighWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "ERP Tx Light Level High Window Size", - "description": "Window size for the alert" - } - }, - "ERPTxLightLevelHighEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "ERP Tx Light Level High Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "ERPTxLightLevelHighPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "ERP Tx Light Level High Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "ERPTxLightLevelHighAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "ERP Tx Light Level High Alert State", - "description": "Alert state for the alert" - } - }, - "ERPTxLightLevelLowAlertSeverity": { - "type": "String", - "defaultValue": "1", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "ERP Tx Light Level Low Alert Severity", - "description": "Severity of the alert" - } - }, - "ERPTxLightLevelLowWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "ERP Tx Light Level Low Window Size", - "description": "Window size for the alert" - } - }, - "ERPTxLightLevelLowEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "ERP Tx Light Level Low Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "ERPTxLightLevelLowPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "ERP Tx Light Level Low Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "ERPTxLightLevelLowAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "ERP Tx Light Level Low Alert State", - "description": "Alert state for the alert" - } - } - }, - "policyDefinitions": [ - { - "policyDefinitionReferenceId": "ALZ_ERCIRQoSDropBitsinPerSec", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ERCIR_QosDropBitsInPerSecond_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('ERCIRQoSDropBitsinPerSecAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('ERCIRQoSDropBitsinPerSecWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('ERCIRQoSDropBitsinPerSecEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('ERCIRQoSDropBitsinPerSecPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('ERCIRQoSDropBitsinPerSecAlertState')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_ERCIRQoSDropBitsoutPerSec", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ERCIR_QosDropBitsOutPerSecond_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('ERCIRQoSDropBitsoutPerSecAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('ERCIRQoSDropBitsoutPerSecWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('ERCIRQoSDropBitsoutPerSecEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('ERCIRQoSDropBitsoutPerSecPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('ERCIRQoSDropBitsoutPerSecAlertState')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_VPNGwBGPPeerStatus", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VPNGw_BGPPeerStatus_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('VPNGwBGPPeerStatusAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('VPNGwBGPPeerStatusWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('VPNGwBGPPeerStatusEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('VPNGwBGPPeerStatusPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('VPNGwBGPPeerStatusAlertState')]" - }, - "threshold": { - "value": "[[[parameters('VPNGwBGPPeerStatusThreshold')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_VnetGwERCpuUtil", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VnetGw_ExpressRouteCpuUtil_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('VnetGwERCpuUtilAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('VnetGwERCpuUtilWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('VnetGwERCpuUtilEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('VnetGwERCpuUtilPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('VnetGwERCpuUtilAlertState')]" - }, - "threshold": { - "value": "[[[parameters('VnetGwERCpuUtilThreshold')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_VnetGwTunnelBW", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VnetGw_TunnelBandwidth_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('VnetGwTunnelBWAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('VnetGwTunnelBWWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('VnetGwTunnelBWEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('VnetGwTunnelBWPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('VnetGwTunnelBWAlertState')]" - }, - "threshold": { - "value": "[[[parameters('VnetGwTunnelBWThreshold')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_VnetGwTunnelEgress", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VnetGw_TunnelEgress_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('VnetGwTunnelEgressAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('VnetGwTunnelEgressWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('VnetGwTunnelEgressEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('VnetGwTunnelEgressPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('VnetGwTunnelEgressAlertState')]" - }, - "threshold": { - "value": "[[[parameters('VnetGwTunnelEgressThreshold')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_VnetGwTunnelIngress", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VnetGw_TunnelIngress_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('VnetGwTunnelIngressAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('VnetGwTunnelIngressWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('VnetGwTunnelIngressEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('VnetGwTunnelIngressPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('VnetGwTunnelIngressAlertState')]" - }, - "threshold": { - "value": "[[[parameters('VnetGwTunnelIngressThreshold')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_VPNGWBandWidthUtil", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VPNGw_BandwidthUtil_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('VPNGWBandWidthUtilAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('VPNGWBandWidthUtilWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('VPNGWBandWidthUtilEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('VPNGWBandWidthUtilPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('VPNGWBandWidthUtilAlertState')]" - }, - "threshold": { - "value": "[[[parameters('VPNGWBandWidthUtilThreshold')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_VPNGWEgress", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VPNGw_Egress_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('VPNGWEgressAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('VPNGWEgressWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('VPNGWEgressEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('VPNGWEgressPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('VPNGWEgressAlertState')]" - }, - "threshold": { - "value": "[[[parameters('VPNGWEgressThreshold')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_VPNGWTunnelEgressPacketDropCount", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VPNGw_TunnelEgressPacketDropCount_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('VPNGWTunnelEgressPacketDropCountAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('VPNGWTunnelEgressPacketDropCountWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('VPNGWTunnelEgressPacketDropCountFrequency')]" - }, - "effect": { - "value": "[[[parameters('VPNGWTunnelEgressPacketDropCountPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('VPNGWTunnelEgressPacketDropCountAlertState')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_VPNGWTunnelEgressPacketDropMismatch", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VPNGw_TunnelEgressPacketDropMismatch_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('VPNGWTunnelEgressPacketDropMismatchAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('VPNGWTunnelEgressPacketDropMismatchWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('VPNGWTunnelEgressPacketDropMismatchFrequency')]" - }, - "effect": { - "value": "[[[parameters('VPNGWTunnelEgressPacketDropMismatchPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('VPNGWTunnelEgressPacketDropMismatchAlertState')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_VPNGWIngress", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VPNGw_Ingress_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('VPNGWIngressAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('VPNGWIngressWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('VPNGWIngressEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('VPNGWIngressPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('VPNGWIngressAlertState')]" - }, - "threshold": { - "value": "[[[parameters('VPNGWIngressThreshold')]" - }, - "autoMitigate": { - "value": "[[[parameters('VPNGWIngressAutoMitigate')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_VPNGWTunnelIngressPacketDropCount", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VPNGw_TunnelIngressPacketDropCount_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('VPNGWTunnelIngressPacketDropCountAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('VPNGWTunnelIngressPacketDropCountWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('VPNGWTunnelIngressPacketDropCountFrequency')]" - }, - "effect": { - "value": "[[[parameters('VPNGWTunnelIngressPacketDropCountPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('VPNGWTunnelIngressPacketDropCountAlertState')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_VPNGWTunnelIngressPacketDropMismatch", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VPNGw_TunnelIngressPacketDropMismatch_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('VPNGWTunnelIngressPacketDropMismatchAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('VPNGWTunnelIngressPacketDropMismatchWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('VPNGWTunnelIngressPacketDropMismatchFrequency')]" - }, - "effect": { - "value": "[[[parameters('VPNGWTunnelIngressPacketDropMismatchPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('VPNGWTunnelIngressPacketDropMismatchAlertState')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_PDNSZCapacityUtil", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_PDNSZ_CapacityUtil_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('PDNSZCapacityUtilAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('PDNSZCapacityUtilWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('PDNSZCapacityUtilEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('PDNSZCapacityUtilPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('PDNSZCapacityUtilAlertState')]" - }, - "threshold": { - "value": "[[[parameters('PDNSZCapacityUtilThreshold')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_PDNSZQueryVolume", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_PDNSZ_QueryVolume_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('PDNSZQueryVolumeAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('PDNSZQueryVolumeWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('PDNSZQueryVolumeEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('PDNSZQueryVolumePolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('PDNSZQueryVolumeAlertState')]" - }, - "threshold": { - "value": "[[[parameters('PDNSZQueryVolumeThreshold')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_PDNSZRecordSetCapacity", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_PDNSZ_RecordSetCapacity_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('PDNSZRecordSetCapacityAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('PDNSZRecordSetCapacityWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('PDNSZRecordSetCapacityEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('PDNSZRecordSetCapacityPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('PDNSZRecordSetCapacityAlertState')]" - }, - "threshold": { - "value": "[[[parameters('PDNSZRecordSetCapacityThreshold')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_PDNSZRegistrationCapacityUtil", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_DNSZ_RegistrationCapacityUtil_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('PDNSZRegistrationCapacityUtilAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('PDNSZRegistrationCapacityUtilWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('PDNSZRegistrationCapacityUtilEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('PDNSZRegistrationCapacityUtilPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('PDNSZRegistrationCapacityUtilAlertState')]" - }, - "threshold": { - "value": "[[[parameters('PDNSZRegistrationCapacityUtilThreshold')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_ERGwExpressRouteBitsIn", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ERGw_ExpressRouteBitsIn_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('ERGwExpressRouteBitsInAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('ERGwExpressRouteBitsInWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('ERGwExpressRouteBitsInEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('ERGwExpressRouteBitsInPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('ERGwExpressRouteBitsInAlertState')]" - }, - "threshold": { - "value": "[[[parameters('ERGwExpressRouteBitsInThreshold')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_ERGwExpressRouteBitsOut", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ERGw_ExpressRouteBitsOut_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('ERGwExpressRouteBitsOutAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('ERGwExpressRouteBitsOutWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('ERGwExpressRouteBitsOutEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('ERGwExpressRouteBitsOutPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('ERGwExpressRouteBitsOutAlertState')]" - }, - "threshold": { - "value": "[[[parameters('ERGwExpressRouteBitsOutThreshold')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_ERGwExpressRouteCpuUtil", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ERGw_ExpressRouteCpuUtil_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('ERGwExpressRouteCpuUtilAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('ERGwExpressRouteCpuUtilWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('ERGwExpressRouteCpuUtilEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('ERGwExpressRouteCpuUtilPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('ERGwExpressRouteCpuUtilAlertState')]" - }, - "threshold": { - "value": "[[[parameters('ERGwExpressRouteCpuUtilThreshold')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_VnetGwTunnelEgressPacketDropCount", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VnetGw_TunnelEgressPacketDropCount_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('VnetGwTunnelEgressPacketDropCountAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('VnetGwTunnelEgressPacketDropCountWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('VnetGwTunnelEgressPacketDropCountEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('VnetGwTunnelEgressPacketDropCountPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('VnetGwTunnelEgressPacketDropCountAlertState')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_VnetGwTunnelEgressPacketDropMismatch", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VnetGw_TunnelEgressPacketDropMismatch_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('VnetGwTunnelEgressPacketDropMismatchAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('VnetGwTunnelEgressPacketDropMismatchWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('VnetGwTunnelEgressPacketDropMismatchEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('VnetGwTunnelEgressPacketDropMismatchPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('VnetGwTunnelEgressPacketDropMismatchAlertState')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_VnetGwExpressRouteBitsPerSecond", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VnetGw_ExpressRouteBitsPerSecond_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('VnetGwExpressRouteBitsPerSecondAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('VnetGwExpressRouteBitsPerSecondWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('VnetGwExpressRouteBitsPerSecondEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('VnetGwExpressRouteBitsPerSecondPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('VnetGwExpressRouteBitsPerSecondAlertState')]" - }, - "threshold": { - "value": "[[[parameters('VnetGwExpressRouteBitsPerSecondThreshold')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_VnetGwTunnelIngressPacketDropMismatch", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VnetGw_TunnelIngressPacketDropMismatch_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('VnetGwTunnelIngressPacketDropMismatchAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('VnetGwTunnelIngressPacketDropMismatchWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('VnetGwTunnelIngressPacketDropMismatchEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('VnetGwTunnelIngressPacketDropMismatchPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('VnetGwTunnelIngressPacketDropMismatchAlertState')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_VnetGwTunnelIngressPacketDropCount", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VnetGw_TunnelIngressPacketDropCount_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('VnetGwTunnelIngressPacketDropCountAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('VnetGwTunnelIngressPacketDropCountWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('VnetGwTunnelIngressPacketDropCountEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('VnetGwTunnelIngressPacketDropCountPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('VnetGwTunnelIngressPacketDropCountAlertState')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_ERCIRBgpAvailability", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ERCIR_BgpAvailability_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('ERCIRBgpAvailabilityAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('ERCIRBgpAvailabilityWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('ERCIRBgpAvailabilityEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('ERCIRBgpAvailabilityPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('ERCIRBgpAvailabilityAlertState')]" - }, - "threshold": { - "value": "[[[parameters('ERCIRBgpAvailabilityThreshold')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_ERCIRArpAvailability", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ERCIR_ArpAvailability_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('ERCIRArpAvailabilityAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('ERCIRArpAvailabilityWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('ERCIRArpAvailabilityFrequency')]" - }, - "effect": { - "value": "[[[parameters('ERCIRArpAvailabilityPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('ERCIRArpAvailabilityAlertState')]" - }, - "threshold": { - "value": "[[[parameters('ERCIRArpAvailabilityThreshold')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_AFWSNATPortUtilization", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_AFW_SNATPortUtilization_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('AFWSNATPortUtilizationAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('AFWSNATPortUtilizationWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('AFWSNATPortUtilizationFrequency')]" - }, - "effect": { - "value": "[[[parameters('AFWSNATPortUtilizationPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('AFWSNATPortUtilizationAlertState')]" - }, - "threshold": { - "value": "[[[parameters('AFWSNATPortUtilizationThreshold')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_PIPBytesInDDoSEvaluationFrequency", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_PublicIp_BytesInDDoSAttack_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('PIPBytesInDDoSAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('PIPBytesInDDoSWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('PIPBytesInDDoSEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('PIPBytesInDDoSPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('PIPBytesInDDoSAlertState')]" - }, - "threshold": { - "value": "[[[parameters('PIPBytesInDDoSThreshold')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_PIPDDoSAttack", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_PublicIp_DDoSAttack_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('PIPDDoSAttackAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('PIPDDoSAttackWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('PIPDDoSAttackEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('PIPDDoSAttackPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('PIPDDoSAttackAlertState')]" - }, - "threshold": { - "value": "[[[parameters('PIPDDoSAttackThreshold')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_PIPPacketsInDDoS", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_PublicIp_PacketsInDDoSAttack_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('PIPPacketsInDDoSAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('PIPPacketsInDDoSWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('PIPPacketsInDDoSEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('PIPPacketsInDDoSPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('PIPPacketsInDDoSAlertState')]" - }, - "threshold": { - "value": "[[[parameters('PIPPacketsInDDoSThreshold')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_PIPVIPAvailability", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_PublicIp_VIPAvailability_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('PIPVIPAvailabilityAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('PIPVIPAvailabilityWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('PIPVIPAvailabilityEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('PIPVIPAvailabilityPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('PIPVIPAvailabilityAlertState')]" - }, - "threshold": { - "value": "[[[parameters('PIPVIPAvailabilityThreshold')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_VNETDDOSAttack", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VNET_DDoSAttack_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('VNETDDOSAttackAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('VNETDDOSAttackWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('VNETDDOSAttackEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('VNETDDOSAttackPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('VNETDDOSAttackAlertState')]" - }, - "threshold": { - "value": "[[[parameters('VNETDDOSAttackThreshold')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_FirewallHealth", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_AFW_FirewallHealth_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('FirewallHealthAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('FirewallHealthWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('FirewallHealthEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('FirewallHealthPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('FirewallHealthAlertState')]" - }, - "threshold": { - "value": "[[[parameters('FirewallHealthThreshold')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_activityFWDelete", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_Firewall_Delete", - "parameters": { - "enabled": { - "value": "[[[parameters('activityFWDeleteAlertState')]" - }, - "alertResourceGroupName": { - "value": "[[[parameters('ALZMonitorResourceGroupName')]" - }, - "alertResourceGroupTags": { - "value": "[[[parameters('ALZMonitorResourceGroupTags')]" - }, - "alertResourceGroupLocation": { - "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_activityNSGDelete", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_NSG_Delete", - "parameters": { - "enabled": { - "value": "[[[parameters('activityNSGDeleteAlertState')]" - }, - "alertResourceGroupName": { - "value": "[[[parameters('ALZMonitorResourceGroupName')]" - }, - "alertResourceGroupTags": { - "value": "[[[parameters('ALZMonitorResourceGroupTags')]" - }, - "alertResourceGroupLocation": { - "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_activityUDRUpdate", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_RouteTable_Update", - "parameters": { - "enabled": { - "value": "[[[parameters('activityUDRUpdateAlertState')]" - }, - "alertResourceGroupName": { - "value": "[[[parameters('ALZMonitorResourceGroupName')]" - }, - "alertResourceGroupTags": { - "value": "[[[parameters('ALZMonitorResourceGroupTags')]" - }, - "alertResourceGroupLocation": { - "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_activityVPNGWDelete", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_VPNGateway_Delete", - "parameters": { - "enabled": { - "value": "[[[parameters('activityVPNGWDeleteAlertState')]" - }, - "alertResourceGroupName": { - "value": "[[[parameters('ALZMonitorResourceGroupName')]" - }, - "alertResourceGroupTags": { - "value": "[[[parameters('ALZMonitorResourceGroupTags')]" - }, - "alertResourceGroupLocation": { - "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_LBDataPathAvailability", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ALB_DataPathAvailability_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('LBDataPathAvailabilityAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('LBDataPathAvailabilityWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('LBDataPathAvailabilityEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('LBDataPathAvailabilityPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('LBDataPathAvailabilityAlertState')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_LBGlobalBackendAvailability", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ALB_GlobalBackendAvailability_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('LBGlobalBackendAvailabilityAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('LBGlobalBackendAvailabilityWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('LBGlobalBackendAvailabilityEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('LBGlobalBackendAvailabilityPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('LBGlobalBackendAvailabilityAlertState')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_LBHealthProbeStatus", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ALB_HealthProbeStatus_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('LBHealthProbeStatusAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('LBHealthProbeStatusWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('LBHealthProbeStatusEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('LBHealthProbeStatusPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('LBHealthProbeStatusAlertState')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_LBUsedSNATPorts", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ALB_UsedSNATPorts_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('LBUsedSNATPortsAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('LBUsedSNATPortsWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('LBUsedSNATPortsEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('LBUsedSNATPortsPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('LBUsedSNATPortsAlertState')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_ERPBitsInPerSecond", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ERP_ExpressRouteBitsIn_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('ERPBitsInPerSecondAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('ERPBitsInPerSecondWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('ERPBitsInPerSecondEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('ERPBitsInPerSecondPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('ERPBitsInPerSecondAlertState')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_ERPBitsOutPerSecond", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ERP_ExpressRouteBitsOut_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('ERPBitsOutPerSecondAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('ERPBitsOutPerSecondWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('ERPBitsOutPerSecondEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('ERPBitsOutPerSecondPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('ERPBitsOutPerSecondAlertState')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_ERPLineProtocol", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ERP_ExpressRoutLineProtocol_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('ERPLineProtocolAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('ERPLineProtocolWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('ERPLineProtocolEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('ERPLineProtocolPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('ERPLineProtocolAlertState')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_ERPRxLightLevelHigh", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ERP_ExpressRoutRxLightLevel_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('ERPRxLightLevelHighAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('ERPRxLightLevelHighWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('ERPRxLightLevelHighEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('ERPRxLightLevelHighPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('ERPRxLightLevelHighAlertState')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_ERPRxLightLevelLow", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ERP_ExpressRoutRxLightLevellow_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('ERPRxLightLevelLowAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('ERPRxLightLevelLowWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('ERPRxLightLevelLowEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('ERPRxLightLevelLowPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('ERPRxLightLevelLowAlertState')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_ERPTxLightLevelHigh", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ERP_ExpressRoutTxLightLevell_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('ERPTxLightLevelHighAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('ERPTxLightLevelHighWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('ERPTxLightLevelHighEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('ERPTxLightLevelHighPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('ERPTxLightLevelHighAlertState')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_ERPTxLightLevelLow", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ERP_ExpressRoutTxLightLevellow_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('ERPTxLightLevelLowAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('ERPTxLightLevelLowWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('ERPTxLightLevelLowEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('ERPTxLightLevelLowPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('ERPTxLightLevelLowAlertState')]" - } - } - } - ], - "policyType": "Custom", - "policyDefinitionGroups": null - } - }, - "$fxv#116": { - "type": "Microsoft.Authorization/policySetDefinitions", - "apiVersion": "2021-06-01", - "name": "Alerting-Identity", - "properties": { - "displayName": "Deploy Azure Monitor Baseline Alerts for Identity", - "description": "Initiative to deploy AMBA alerts relevant to the ALZ Identity management group", - "metadata": { - "version": "1.0.3", - "category": "Monitoring", - "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", - "alzCloudEnvironments": [ - "AzureCloud" - ], - "_deployed_by_amba": true - }, - "parameters": { - "ALZMonitorResourceGroupName": { - "type": "String", - "defaultValue": "ALZ-Monitoring-RG", - "metadata": { - "displayName": "ALZ Monitor Resource Group Name", - "description": "Name of the resource group where the alerting resources will be deployed" - } - }, - "ALZMonitorResourceGroupTags": { - "type": "Object", - "defaultValue": { - "_deployed_by_alz_monitor": true - }, - "metadata": { - "displayName": "ALZ Monitor Resource Group Tags", - "description": "Tags for the resource group where the alerting resources will be deployed" - } - }, - "ALZMonitorResourceGroupLocation": { - "type": "String", - "defaultValue": "centralus", - "metadata": { - "displayName": "ALZ Monitor Resource Group Location", - "description": "Location of the resource group where the alerting resources will be deployed" - } - }, - "KVRequestAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "KeyVault Request Alert Severity", - "description": "Severity of the alert" - } - }, - "KVRequestWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "KeyVault Request Alert Window Size", - "description": "Window size for the alert" - } - }, - "KVRequestEvaluationFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "KeyVault Request Alert Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "KVRequestPolicyEffect": { - "type": "string", - "defaultValue": "disabled", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "KeyVault Request Alert Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "KVRequestAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "KeyVault Request Alert State", - "description": "State of the alert, true will enable the alert, false will disable the alert" - } - }, - "KvAvailabilityAlertSeverity": { - "type": "String", - "defaultValue": "1", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "KeyVault Availability Alert Severity", - "description": "Severity of the alert" - } - }, - "KvAvailabilityWindowSize": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "KeyVault Availability Alert Window Size", - "description": "Window size for the alert" - } - }, - "KvAvailabilityEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "KeyVault Availability Alert Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "KvAvailabilityPolicyEffect": { - "type": "string", - "defaultValue": "disabled", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "KeyVault Availability Alert Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "KvAvailabilityAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "KeyVault Availability Alert State", - "description": "State of the alert, true will enable the alert, false will disable the alert" - } - }, - "KVAvailabilityThreshold": { - "type": "string", - "defaultValue": "20", - "metadata": { - "displayName": "KeyVault Availability Alert Threshold", - "description": "Threshold for the alert" - } - }, - "KvLatencyAvailabilityAlertSeverity": { - "type": "String", - "defaultValue": "3", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "KeyVault Latency Alert Severity", - "description": "Severity of the alert" - } - }, - "KvLatencyAvailabilityWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "KeyVault Latency Alert Window Size", - "description": "Window size for the alert" - } - }, - "KvLatencyAvailabilityEvaluationFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "KeyVault Latency Alert Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "KvLatencyAvailabilityPolicyEffect": { - "type": "string", - "defaultValue": "disabled", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "KeyVault Latency Alert Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "KvLatencyAvailabilityAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "KeyVault Latency Alert State", - "description": "State of the alert, true will enable the alert, false will disable the alert" - } - }, - "KvLatencyAvailabilityThreshold": { - "type": "string", - "defaultValue": "1000", - "metadata": { - "displayName": "KeyVault Latency Alert Threshold", - "description": "Threshold for the alert" - } - }, - "KVCapacityAlertSeverity": { - "type": "String", - "defaultValue": "1", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "KeyVault Capacity Alert Severity", - "description": "Severity of the alert" - } - }, - "KVCapacityWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "KeyVault Capacity Alert Window Size", - "description": "Window size for the alert" - } - }, - "KVCapacityEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "KeyVault Capacity Alert Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "KVCapacityPolicyEffect": { - "type": "string", - "defaultValue": "disabled", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "KeyVault Capacity Alert Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "KVCapacityAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "KeyVault Capacity Alert State", - "description": "State of the alert, true will enable the alert, false will disable the alert" - } - }, - "KVCapacityThreshold": { - "type": "string", - "defaultValue": "75", - "metadata": { - "displayName": "KeyVault Capacity Alert Threshold", - "description": "Threshold for the alert" - } - }, - "activityKVDeleteAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Activity Log KeyVault Delete Alert State", - "description": "State of the alert, true will enable the alert, false will disable the alert" - } - } - }, - "policyDefinitions": [ - { - "policyDefinitionReferenceId": "ALZ_KVRequest", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_KeyVault_Requests_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('KVRequestAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('KVRequestWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('KVRequestEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('KVRequestPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('KVRequestAlertState')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_KvAvailability", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_KeyVault_Availability_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('KvAvailabilityAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('KvAvailabilityWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('KvAvailabilityEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('KvAvailabilityPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('KvAvailabilityAlertState')]" - }, - "threshold": { - "value": "[[[parameters('KVAvailabilityThreshold')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_KvLatencyAvailability", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_KeyVault_Latency_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('KvLatencyAvailabilityAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('KvLatencyAvailabilityWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('KvLatencyAvailabilityEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('KvLatencyAvailabilityPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('KvLatencyAvailabilityAlertState')]" - }, - "threshold": { - "value": "[[[parameters('KvLatencyAvailabilityThreshold')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_KVCapacity", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_KeyVault_Capacity_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('KVCapacityAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('KVCapacityWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('KVCapacityEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('KVCapacityPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('KVCapacityAlertState')]" - }, - "threshold": { - "value": "[[[parameters('KVCapacityThreshold')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_activityKVDelete", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_KeyVault_Delete", - "parameters": { - "enabled": { - "value": "[[[parameters('activityKVDeleteAlertState')]" - }, - "alertResourceGroupName": { - "value": "[[[parameters('ALZMonitorResourceGroupName')]" - }, - "alertResourceGroupTags": { - "value": "[[[parameters('ALZMonitorResourceGroupTags')]" - }, - "alertResourceGroupLocation": { - "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" - } - } - } - ], - "policyType": "Custom", - "policyDefinitionGroups": null - } - }, - "$fxv#117": { - "type": "Microsoft.Authorization/policySetDefinitions", - "apiVersion": "2021-06-01", - "name": "Alerting-LandingZone", - "properties": { - "displayName": "Deploy Azure Monitor Baseline Alerts for Landing Zone", - "description": "Initiative to deploy AMBA alerts relevant to the ALZ LandingZone management group", - "metadata": { - "version": "1.1.0", - "category": "Monitoring", - "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", - "alzCloudEnvironments": [ - "AzureCloud" - ], - "_deployed_by_amba": true - }, - "parameters": { - "ALZMonitorResourceGroupName": { - "type": "String", - "defaultValue": "ALZ-Monitoring-RG", - "metadata": { - "displayName": "ALZ Monitor Resource Group Name", - "description": "Name of the resource group where the ALZ Monitor resources will be deployed" - } - }, - "ALZMonitorResourceGroupTags": { - "type": "Object", - "defaultValue": { - "_deployed_by_alz_monitor": true - }, - "metadata": { - "displayName": "ALZ Monitor Resource Group Tags", - "description": "Tags for the resource group where the ALZ Monitor resources will be deployed" - } - }, - "ALZMonitorResourceGroupLocation": { - "type": "String", - "defaultValue": "centralus", - "metadata": { - "displayName": "ALZ Monitor Resource Group Location", - "description": "Location of the resource group where the ALZ Monitor resources will be deployed" - } - }, - "KVRequestAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "Key Vault Request Alert Severity", - "description": "Severity of the alert for Key Vault Request" - } - }, - "KVRequestWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "Key Vault Request Window Size", - "description": "Window size for the alert" - } - }, - "KVRequestEvaluationFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "Key Vault Request Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "KVRequestPolicyEffect": { - "type": "string", - "defaultValue": "disabled", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "Key Vault Request Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" - } - }, - "KVRequestAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Key Vault Request Alert State", - "description": "Alert state for the alert" - } - }, - "KvAvailabilityAlertSeverity": { - "type": "String", - "defaultValue": "1", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "Key Vault Availability Alert Severity", - "description": "Severity of the alert for Key Vault Availability" - } - }, - "KvAvailabilityWindowSize": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "Key Vault Availability Window Size", - "description": "Window size for the alert" - } - }, - "KvAvailabilityEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "Key Vault Availability Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "KvAvailabilityPolicyEffect": { - "type": "string", - "defaultValue": "disabled", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "Key Vault Availability Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" - } - }, - "KvAvailabilityAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Key Vault Availability Alert State", - "description": "Alert state for the alert" - } - }, - "KVAvailabilityThreshold": { - "type": "string", - "defaultValue": "20", - "metadata": { - "displayName": "Key Vault Availability Threshold", - "description": "Threshold for the alert" - } - }, - "KvLatencyAvailabilityAlertSeverity": { - "type": "String", - "defaultValue": "3", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "Key Vault Latency Availability Alert Severity", - "description": "Severity of the alert for Key Vault Latency Availability" - } - }, - "KvLatencyAvailabilityWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "Key Vault Latency Availability Window Size", - "description": "Window size for the alert" - } - }, - "KvLatencyAvailabilityEvaluationFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "Key Vault Latency Availability Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "KvLatencyAvailabilityPolicyEffect": { - "type": "string", - "defaultValue": "disabled", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "Key Vault Latency Availability Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" - } - }, - "KvLatencyAvailabilityAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Key Vault Latency Availability Alert State", - "description": "Alert state for the alert" - } - }, - "KvLatencyAvailabilityThreshold": { - "type": "string", - "defaultValue": "1000", - "metadata": { - "displayName": "Key Vault Latency Availability Threshold", - "description": "Threshold for the alert" - } - }, - "KVCapacityAlertSeverity": { - "type": "String", - "defaultValue": "1", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "Key Vault Capacity Alert Severity", - "description": "Severity of the alert for Key Vault Capacity" - } - }, - "KVCapacityWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "Key Vault Capacity Window Size", - "description": "Window size for the alert" - } - }, - "KVCapacityEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "Key Vault Capacity Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "KVCapacityPolicyEffect": { - "type": "string", - "defaultValue": "disabled", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "Key Vault Capacity Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" - } - }, - "KVCapacityAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Key Vault Capacity Alert State", - "description": "Alert state for the alert" - } - }, - "KVCapacityThreshold": { - "type": "string", - "defaultValue": "75", - "metadata": { - "displayName": "Key Vault Capacity Threshold", - "description": "Threshold for the alert" - } - }, - "activityKVDeleteAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Activity Key Vault Delete Alert State", - "description": "Alert state for the alert" - } - }, - "StorageAccountAvailabilityAlertSeverity": { - "type": "String", - "defaultValue": "1", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "Storage Account Availability Alert Severity", - "description": "Severity of the alert for Storage Account Availability" - } - }, - "StorageAccountAvailabilityWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "Storage Account Availability Window Size", - "description": "Window size for the alert" - } - }, - "StorageAccountAvailabilityFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "Storage Account Availability Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "StorageAccountAvailabilityPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "Storage Account Availability Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" - } - }, - "StorageAccountAvailabilityAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Storage Account Availability Alert State", - "description": "Alert state for the alert" - } - }, - "StorageAccountAvailabilityThreshold": { - "type": "string", - "defaultValue": "90", - "metadata": { - "displayName": "Storage Account Availability Threshold", - "description": "Threshold for the alert" - } - }, - "StorageAccountDeletePolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "Storage Account Delete Alert Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will create the alert if it does not exist, disabled will not create the alert" - } - }, - "StorageAccountDeleteAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Storage Account Delete Alert State", - "description": "Alert state for the alert" - } - }, - "PIPDDoSAttackAlertSeverity": { - "type": "String", - "defaultValue": "1", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "PIP DDoS Attack Alert Severity", - "description": "Severity of the alert for PIP DDoS Attack" - } - }, - "PIPDDoSAttackWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "PIP DDoS Attack Window Size", - "description": "Window size for the alert" - } - }, - "PIPDDoSAttackEvaluationFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "PIP DDoS Attack Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "PIPDDoSAttackPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "PIP DDoS Attack Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" - } - }, - "PIPDDoSAttackAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "PIP DDoS Attack Alert State", - "description": "Alert state for the alert" - } - }, - "PIPDDoSAttackThreshold": { - "type": "string", - "defaultValue": "0", - "metadata": { - "displayName": "PIP DDoS Attack Threshold", - "description": "Threshold for the alert" - } - }, - "PIPPacketsInDDoSAlertSeverity": { - "type": "String", - "defaultValue": "4", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "PIP Packets In DDoS Alert Severity", - "description": "Severity of the alert for PIP Packets In DDoS" - } - }, - "PIPPacketsInDDoSWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "PIP Packets In DDoS Window Size", - "description": "Window size for the alert" - } - }, - "PIPPacketsInDDoSEvaluationFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "PIP Packets In DDoS Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "PIPPacketsInDDoSPolicyEffect": { - "type": "string", - "defaultValue": "disabled", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "PIP Packets In DDoS Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" - } - }, - "PIPPacketsInDDoSAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "PIP Packets In DDoS Alert State", - "description": "Alert state for the alert" - } - }, - "PIPPacketsInDDoSThreshold": { - "type": "string", - "defaultValue": "40000", - "metadata": { - "displayName": "PIP Packets In DDoS Threshold", - "description": "Threshold for the alert" - } - }, - "PIPVIPAvailabilityAlertSeverity": { - "type": "String", - "defaultValue": "1", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "PIP VIP Availability Alert Severity", - "description": "Severity of the alert for PIP VIP Availability" - } - }, - "PIPVIPAvailabilityWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "PIP VIP Availability Window Size", - "description": "Window size for the alert" - } - }, - "PIPVIPAvailabilityEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "PIP VIP Availability Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "PIPVIPAvailabilityPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "PIP VIP Availability Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" - } - }, - "PIPVIPAvailabilityAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "PIP VIP Availability Alert State", - "description": "Alert state for the alert" - } - }, - "PIPVIPAvailabilityThreshold": { - "type": "string", - "defaultValue": "1", - "metadata": { - "displayName": "PIP VIP Availability Threshold", - "description": "Threshold for the alert" - } - }, - "PIPBytesInDDoSAlertSeverity": { - "type": "String", - "defaultValue": "4", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "PIP Bytes In DDoS Alert Severity", - "description": "Severity of the alert for PIP Bytes In DDoS" - } - }, - "PIPBytesInDDoSWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "PIP Bytes In DDoS Window Size", - "description": "Window size for the alert" - } - }, - "PIPBytesInDDoSEvaluationFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "PIP Bytes In DDoS Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "PIPBytesInDDoSPolicyEffect": { - "type": "string", - "defaultValue": "disabled", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "PIP Bytes In DDoS Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" - } - }, - "PIPBytesInDDoSAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "PIP Bytes In DDoS Alert State", - "description": "Alert state for the alert" - } - }, - "PIPBytesInDDoSThreshold": { - "type": "string", - "defaultValue": "8000000", - "metadata": { - "displayName": "PIP Bytes In DDoS Threshold", - "description": "Threshold for the alert" - } - }, - "RVBackupHealthMonitorPolicyEffect": { - "type": "string", - "defaultValue": "modify", - "allowedValues": [ - "modify", - "audit", - "disabled" - ], - "metadata": { - "displayName": "Recovery Vault Backup Health Monitor Policy Effect", - "description": "Policy effect for the alert, modify will modify the alert if it exists, or audit if it does not exist" - } - }, - "VNETDDOSAttackAlertSeverity": { - "type": "String", - "defaultValue": "1", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "VNET DDoS Attack Alert Severity", - "description": "Severity of the alert for VNET DDoS Attack" - } - }, - "VNETDDOSAttackWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "VNET DDoS Attack Window Size", - "description": "Window size for the alert" - } - }, - "VNETDDOSAttackEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "VNET DDoS Attack Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "VNETDDOSAttackPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "VNET DDoS Attack Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" - } - }, - "VNETDDOSAttackAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "VNET DDoS Attack Alert State", - "description": "Alert state for the alert" - } - }, - "VNETDDOSAttackThreshold": { - "type": "string", - "defaultValue": "1", - "metadata": { - "displayName": "VNET DDoS Attack Threshold", - "description": "Threshold for the alert" - } - }, - "activityNSGDeleteAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Activity NSG Delete Alert State", - "description": "Alert state for the alert" - } - }, - "activityUDRUpdateAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Activity UDR Update Alert State", - "description": "Alert state for the alert" - } - }, - "VMHeartBeatRGAlertSeverity": { - "type": "String", - "defaultValue": "1", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "VM Heart Beat RG Alert Severity", - "description": "Severity of the alert for VM Heart Beat RG" - } - }, - "VMHeartBeatRGWindowSize": { - "type": "string", - "defaultValue": "PT15M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "VM Heart Beat RG Window Size", - "description": "Window size for the alert" - } - }, - "VMHeartBeatRGEvaluationFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "VM Heart Beat RG Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "VMHeartBeatRGAutoMitigate": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "VM Heart Beat RG Auto Mitigate", - "description": "Auto Mitigate for the alert" - } - }, - "VMHeartBeatRGAutoResolve": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "VM Heart Beat RG Auto Resolve", - "description": "Auto Resolve for the alert" - } - }, - "VMHeartBeatRGAutoResolveTime": { - "type": "string", - "defaultValue": "00:10:00", - "metadata": { - "displayName": "VM Heart Beat RG Auto Resolve Time", - "description": "Auto Resolve Time for the alert" - } - }, - "VMHeartBeatRGPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "VM Heart Beat RG Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" - } - }, - "VMHeartBeatRGAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "VM Heart Beat RG Alert State", - "description": "Alert state for the alert" - } - }, - "VMHeartBeatRGThreshold": { - "type": "string", - "defaultValue": "10", - "metadata": { - "displayName": "VM Heart Beat RG Threshold", - "description": "Threshold for the alert" - } - }, - "VMHeartBeatRGOperator": { - "type": "string", - "defaultValue": "GreaterThan", - "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" - ], - "metadata": { - "displayName": "VM Heart Beat RG Operator", - "description": "Operator for the alert" - } - }, - "VMHeartBeatRGTimeAggregation": { - "type": "string", - "defaultValue": "Average", - "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" - ], - "metadata": { - "displayName": "VM Heart Beat RG Time Aggregation", - "description": "Time Aggregation for the alert" - } - }, - "VMNetworkInAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "VM Network In Alert Severity", - "description": "Severity of the alert for VM Network In" - } - }, - "VMNetworkInWindowSize": { - "type": "string", - "defaultValue": "PT15M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "VM Network In Window Size", - "description": "Window size for the alert" - } - }, - "VMNetworkInEvaluationFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "VM Network In Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "VMNetworkInAutoMitigate": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "VM Network In Auto Mitigate", - "description": "Auto Mitigate for the alert" - } - }, - "VMNetworkInAutoResolve": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "VM Network In Auto Resolve", - "description": "Auto Resolve for the alert" - } - }, - "VMNetworkInAutoResolveTime": { - "type": "string", - "defaultValue": "00:10:00", - "metadata": { - "displayName": "VM Network In Auto Resolve Time", - "description": "Auto Resolve Time for the alert" - } - }, - "VMNetworkInPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "VM Network In Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" - } - }, - "VMNetworkInAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "VM Network In Alert State", - "description": "Alert state for the alert" - } - }, - "VMNetworkInThreshold": { - "type": "string", - "defaultValue": "10000000", - "metadata": { - "displayName": "VM Network In Threshold", - "description": "Threshold for the alert" - } - }, - "VMNetworkInOperator": { - "type": "string", - "defaultValue": "GreaterThan", - "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" - ], - "metadata": { - "displayName": "VM Network In Operator", - "description": "Operator for the alert" - } - }, - "VMNetworkInTimeAggregation": { - "type": "string", - "defaultValue": "Average", - "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" - ], - "metadata": { - "displayName": "VM Network In Time Aggregation", - "description": "Time Aggregation for the alert" - } - }, - "VMNetworkInEvaluationPeriods": { - "type": "string", - "defaultValue": "1", - "metadata": { - "displayName": "VM Network In Evaluation Periods", - "description": "Evaluation Periods for the alert" - } - }, - "VMNetworkInFailingPeriods": { - "type": "string", - "defaultValue": "1", - "metadata": { - "displayName": "VM Network In Failing Periods", - "description": "Failing Periods for the alert" - } - }, - "VMNetworkInComputersToInclude": { - "type": "array", - "defaultValue": [ - "*" - ], - "metadata": { - "displayName": "VM Network In Computers To Include", - "description": "Computers To Include for the alert" - } - }, - "VMNetworkInNetworkInterfaceToInclude": { - "type": "array", - "defaultValue": [ - "*" - ], - "metadata": { - "displayName": "VM Network In Network Interface To Include", - "description": "Network Interface To Include for the alert" - } - }, - "VMNetworkOutAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "VM Network Out Alert Severity", - "description": "Severity of the alert for VM Network Out" - } - }, - "VMNetworkOutWindowSize": { - "type": "string", - "defaultValue": "PT15M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "VM Network Out Window Size", - "description": "Window size for the alert" - } - }, - "VMNetworkOutEvaluationFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "VM Network Out Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "VMNetworkOutAutoMitigate": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "VM Network Out Auto Mitigate", - "description": "Auto Mitigate for the alert" - } - }, - "VMNetworkOutAutoResolve": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "VM Network Out Auto Resolve", - "description": "Auto Resolve for the alert" - } - }, - "VMNetworkOutAutoResolveTime": { - "type": "string", - "defaultValue": "00:10:00", - "metadata": { - "displayName": "VM Network Out Auto Resolve Time", - "description": "Auto Resolve Time for the alert" - } - }, - "VMNetworkOutPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "VM Network Out Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" - } - }, - "VMNetworkOutAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "VM Network Out Alert State", - "description": "Alert state for the alert, true will enable the alert, false will disable the alert" - } - }, - "VMNetworkOutThreshold": { - "type": "string", - "defaultValue": "10000000", - "metadata": { - "displayName": "VM Network Out Threshold", - "description": "Threshold for the alert" - } - }, - "VMNetworkOutOperator": { - "type": "string", - "defaultValue": "GreaterThan", - "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" - ], - "metadata": { - "displayName": "VM Network Out Operator", - "description": "Operator for the alert" - } - }, - "VMNetworkOutTimeAggregation": { - "type": "string", - "defaultValue": "Average", - "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" - ], - "metadata": { - "displayName": "VM Network Out Time Aggregation", - "description": "Time Aggregation for the alert" - } - }, - "VMNetworkOutEvaluationPeriods": { - "type": "string", - "defaultValue": "1", - "metadata": { - "displayName": "VM Network Out Evaluation Periods", - "description": "Evaluation Periods for the alert" - } - }, - "VMNetworkOutFailingPeriods": { - "type": "string", - "defaultValue": "1", - "metadata": { - "displayName": "VM Network Out Failing Periods", - "description": "Failing Periods for the alert" - } - }, - "VMNetworkOutComputersToInclude": { - "type": "array", - "defaultValue": [ - "*" - ], - "metadata": { - "displayName": "VM Network Out Computers To Include", - "description": "Computers To Include for the alert" - } - }, - "VMNetworkOutNetworkInterfaceToInclude": { - "type": "array", - "defaultValue": [ - "*" - ], - "metadata": { - "displayName": "VM Network Out Network Interface To Include", - "description": "Network Interface To Include for the alert" - } - }, - "VMOSDiskReadLatencyAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "VM OS Disk Read Latency Alert Severity", - "description": "Severity of the alert for VM OS Disk Read Latency" - } - }, - "VMOSDiskReadLatencyWindowSize": { - "type": "string", - "defaultValue": "PT15M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "VM OS Disk Read Latency Window Size", - "description": "Window size for the alert" - } - }, - "VMOSDiskReadLatencyEvaluationFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "VM OS Disk Read Latency Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "VMOSDiskReadLatencyAutoMitigate": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "VM OS Disk Read Latency Auto Mitigate", - "description": "Auto Mitigate for the alert" - } - }, - "VMOSDiskReadLatencyAutoResolve": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "VM OS Disk Read Latency Auto Resolve", - "description": "Auto Resolve for the alert" - } - }, - "VMOSDiskReadLatencyAutoResolveTime": { - "type": "string", - "defaultValue": "00:10:00", - "metadata": { - "displayName": "VM OS Disk Read Latency Auto Resolve Time", - "description": "Auto Resolve Time for the alert" - } - }, - "VMOSDiskReadLatencyPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "VM OS Disk Read Latency Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" - } - }, - "VMOSDiskReadLatencyAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "VM OS Disk Read Latency Alert State", - "description": "Alert state for the alert, true will enable the alert, false will disable the alert" - } - }, - "VMOSDiskReadLatencyThreshold": { - "type": "string", - "defaultValue": "30", - "metadata": { - "displayName": "VM OS Disk Read Latency Threshold", - "description": "Threshold for the alert" - } - }, - "VMOSDiskReadLatencyOperator": { - "type": "string", - "defaultValue": "GreaterThan", - "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" - ], - "metadata": { - "displayName": "VM OS Disk Read Latency Operator", - "description": "Operator for the alert" - } - }, - "VMOSDiskReadLatencyTimeAggregation": { - "type": "string", - "defaultValue": "Average", - "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" - ], - "metadata": { - "displayName": "VM OS Disk Read Latency Time Aggregation", - "description": "Time Aggregation for the alert" - } - }, - "VMOSDiskReadLatencyEvaluationPeriods": { - "type": "string", - "defaultValue": "1", - "metadata": { - "displayName": "VM OS Disk Read Latency Evaluation Periods", - "description": "Evaluation Periods for the alert" - } - }, - "VMOSDiskReadLatencyFailingPeriods": { - "type": "string", - "defaultValue": "1", - "metadata": { - "displayName": "VM OS Disk Read Latency Failing Periods", - "description": "Failing Periods for the alert" - } - }, - "VMOSDiskReadLatencyComputersToInclude": { - "type": "array", - "defaultValue": [ - "*" - ], - "metadata": { - "displayName": "VM OS Disk Read Latency Computers To Include", - "description": "Computers To Include for the alert" - } - }, - "VMOSDiskReadLatencyDisksToInclude": { - "type": "array", - "defaultValue": [ - "C:", - "/" - ], - "metadata": { - "displayName": "VM OS Disk Read Latency Disks To Include", - "description": "Disks To Include for the alert" - } - }, - "VMOSDiskWriteLatencyAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "VM OS Disk Write Latency Alert Severity", - "description": "Severity of the alert for VM OS Disk Write Latency" - } - }, - "VMOSDiskWriteLatencyWindowSize": { - "type": "string", - "defaultValue": "PT15M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "VM OS Disk Write Latency Window Size", - "description": "Window size for the alert" - } - }, - "VMOSDiskWriteLatencyEvaluationFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "VM OS Disk Write Latency Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "VMOSDiskWriteLatencyAutoMitigate": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "VM OS Disk Write Latency Auto Mitigate", - "description": "Auto Mitigate for the alert" - } - }, - "VMOSDiskWriteLatencyAutoResolve": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "VM OS Disk Write Latency Auto Resolve", - "description": "Auto Resolve for the alert" - } - }, - "VMOSDiskWriteLatencyAutoResolveTime": { - "type": "string", - "defaultValue": "00:10:00", - "metadata": { - "displayName": "VM OS Disk Write Latency Auto Resolve Time", - "description": "Auto Resolve Time for the alert" - } - }, - "VMOSDiskWriteLatencyPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "VM OS Disk Write Latency Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" - } - }, - "VMOSDiskWriteLatencyAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "VM OS Disk Write Latency Alert State", - "description": "Alert state for the alert, true will enable the alert, false will disable the alert" - } - }, - "VMOSDiskWriteLatencyThreshold": { - "type": "string", - "defaultValue": "50", - "metadata": { - "displayName": "VM OS Disk Write Latency Threshold", - "description": "Threshold for the alert" - } - }, - "VMOSDiskWriteLatencyOperator": { - "type": "string", - "defaultValue": "GreaterThan", - "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" - ], - "metadata": { - "displayName": "VM OS Disk Write Latency Operator", - "description": "Operator for the alert" - } - }, - "VMOSDiskWriteLatencyTimeAggregation": { - "type": "string", - "defaultValue": "Average", - "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" - ], - "metadata": { - "displayName": "VM OS Disk Write Latency Time Aggregation", - "description": "Time Aggregation for the alert" - } - }, - "VMOSDiskWriteLatencyEvaluationPeriods": { - "type": "string", - "defaultValue": "1", - "metadata": { - "displayName": "VM OS Disk Write Latency Evaluation Periods", - "description": "Evaluation Periods for the alert" - } - }, - "VMOSDiskWriteLatencyFailingPeriods": { - "type": "string", - "defaultValue": "1", - "metadata": { - "displayName": "VM OS Disk Write Latency Failing Periods", - "description": "Failing Periods for the alert" - } - }, - "VMOSDiskWriteLatencyComputersToInclude": { - "type": "array", - "defaultValue": [ - "*" - ], - "metadata": { - "displayName": "VM OS Disk Write Latency Computers To Include", - "description": "Computers To Include for the alert" - } - }, - "VMOSDiskWriteLatencyDisksToInclude": { - "type": "array", - "defaultValue": [ - "C:", - "/" - ], - "metadata": { - "displayName": "VM OS Disk Write Latency Disks To Include", - "description": "Disks To Include for the alert" - } - }, - "VMOSDiskSpaceAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "VM OS Disk Space Alert Severity", - "description": "Severity of the alert for VM OS Disk Space" - } - }, - "VMOSDiskSpaceWindowSize": { - "type": "string", - "defaultValue": "PT15M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "VM OS Disk Space Window Size", - "description": "Window size for the alert" - } - }, - "VMOSDiskSpaceEvaluationFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "VM OS Disk Space Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "VMOSDiskSpaceAutoMitigate": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "VM OS Disk Space Auto Mitigate", - "description": "Auto Mitigate for the alert" - } - }, - "VMOSDiskSpaceAutoResolve": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "VM OS Disk Space Auto Resolve", - "description": "Auto Resolve for the alert" - } - }, - "VMOSDiskSpaceAutoResolveTime": { - "type": "string", - "defaultValue": "00:10:00", - "metadata": { - "displayName": "VM OS Disk Space Auto Resolve Time", - "description": "Auto Resolve Time for the alert" - } - }, - "VMOSDiskSpacePolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "VM OS Disk Space Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" - } - }, - "VMOSDiskSpaceAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "VM OS Disk Space Alert State", - "description": "Alert state for the alert, true will enable the alert, false will disable the alert" - } - }, - "VMOSDiskSpaceThreshold": { - "type": "string", - "defaultValue": "10", - "metadata": { - "displayName": "VM OS Disk Space Threshold", - "description": "Threshold for the alert" - } - }, - "VMOSDiskSpaceOperator": { - "type": "string", - "defaultValue": "LessThan", - "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" - ], - "metadata": { - "displayName": "VM OS Disk Space Operator", - "description": "Operator for the alert" - } - }, - "VMOSDiskSpaceTimeAggregation": { - "type": "string", - "defaultValue": "Average", - "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" - ], - "metadata": { - "displayName": "VM OS Disk Space Time Aggregation", - "description": "Time Aggregation for the alert" - } - }, - "VMOSDiskSpaceEvaluationPeriods": { - "type": "string", - "defaultValue": "1", - "metadata": { - "displayName": "VM OS Disk Space Evaluation Periods", - "description": "Evaluation Periods for the alert" - } - }, - "VMOSDiskSpaceFailingPeriods": { - "type": "string", - "defaultValue": "1", - "metadata": { - "displayName": "VM OS Disk Space Failing Periods", - "description": "Failing Periods for the alert" - } - }, - "VMOSDiskSpaceComputersToInclude": { - "type": "array", - "defaultValue": [ - "*" - ], - "metadata": { - "displayName": "VM OS Disk Space Computers To Include", - "description": "Computers To Include for the alert" - } - }, - "VMOSDiskSpaceDisksToInclude": { - "type": "array", - "defaultValue": [ - "C:", - "/" - ], - "metadata": { - "displayName": "VM OS Disk Space Disks To Include", - "description": "Disks To Include for the alert" - } - }, - "VMPercentCPUAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "VM Percent CPU Alert Severity", - "description": "Severity of the alert for VM Percent CPU" - } - }, - "VMPercentCPUWindowSize": { - "type": "string", - "defaultValue": "PT15M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "VM Percent CPU Window Size", - "description": "Window size for the alert" - } - }, - "VMPercentCPUEvaluationFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "VM Percent CPU Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "VMPercentCPUAutoMitigate": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "VM Percent CPU Auto Mitigate", - "description": "Auto Mitigate for the alert" - } - }, - "VMPercentCPUAutoResolve": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "VM Percent CPU Auto Resolve", - "description": "Auto Resolve for the alert" - } - }, - "VMPercentCPUAutoResolveTime": { - "type": "string", - "defaultValue": "00:10:00", - "metadata": { - "displayName": "VM Percent CPU Auto Resolve Time", - "description": "Auto Resolve Time for the alert" - } - }, - "VMPercentCPUPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "VM Percent CPU Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" - } - }, - "VMPercentCPUAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "VM Percent CPU Alert State", - "description": "Alert state for the alert, true will enable the alert, false will disable the alert" - } - }, - "VMPercentCPUThreshold": { - "type": "string", - "defaultValue": "85", - "metadata": { - "displayName": "VM Percent CPU Threshold", - "description": "Threshold for the alert" - } - }, - "VMPercentCPUOperator": { - "type": "string", - "defaultValue": "GreaterThan", - "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" - ], - "metadata": { - "displayName": "VM Percent CPU Operator", - "description": "Operator for the alert" - } - }, - "VMPercentCPUTimeAggregation": { - "type": "string", - "defaultValue": "Average", - "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" - ], - "metadata": { - "displayName": "VM Percent CPU Time Aggregation", - "description": "Time Aggregation for the alert" - } - }, - "VMPercentMemoryAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "VM Percent Memory Alert Severity", - "description": "Severity of the alert for VM Percent Memory" - } - }, - "VMPercentMemoryWindowSize": { - "type": "string", - "defaultValue": "PT15M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "VM Percent Memory Window Size", - "description": "Window size for the alert" - } - }, - "VMPercentMemoryEvaluationFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "VM Percent Memory Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "VMPercentMemoryAutoMitigate": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "VM Percent Memory Auto Mitigate", - "description": "Auto Mitigate for the alert" - } - }, - "VMPercentMemoryAutoResolve": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "VM Percent Memory Auto Resolve", - "description": "Auto Resolve for the alert" - } - }, - "VMPercentMemoryAutoResolveTime": { - "type": "string", - "defaultValue": "00:10:00", - "metadata": { - "displayName": "VM Percent Memory Auto Resolve Time", - "description": "Auto Resolve Time for the alert" - } - }, - "VMPercentMemoryPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "VM Percent Memory Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" - } - }, - "VMPercentMemoryAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "VM Percent Memory Alert State", - "description": "Alert state for the alert, true will enable the alert, false will disable the alert" - } - }, - "VMPercentMemoryThreshold": { - "type": "string", - "defaultValue": "10", - "metadata": { - "displayName": "VM Percent Memory Threshold", - "description": "Threshold for the alert" - } - }, - "VMPercentMemoryOperator": { - "type": "string", - "defaultValue": "LessThan", - "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" - ], - "metadata": { - "displayName": "VM Percent Memory Operator", - "description": "Operator for the alert" - } - }, - "VMPercentMemoryTimeAggregation": { - "type": "string", - "defaultValue": "Average", - "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" - ], - "metadata": { - "displayName": "VM Percent Memory Time Aggregation", - "description": "Time Aggregation for the alert" - } - }, - "VMDataDiskSpaceAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "VM Data Disk Space Alert Severity", - "description": "Severity of the alert for VM Data Disk Space" - } - }, - "VMDataDiskSpaceWindowSize": { - "type": "string", - "defaultValue": "PT15M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "VM Data Disk Space Window Size", - "description": "Window size for the alert" - } - }, - "VMDataDiskSpaceEvaluationFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "VM Data Disk Space Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "VMDataDiskSpaceAutoMitigate": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "VM Data Disk Space Auto Mitigate", - "description": "Auto Mitigate for the alert" - } - }, - "VMDataDiskSpaceAutoResolve": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "VM Data Disk Space Auto Resolve", - "description": "Auto Resolve for the alert" - } - }, - "VMDataDiskSpaceAutoResolveTime": { - "type": "string", - "defaultValue": "00:10:00", - "metadata": { - "displayName": "VM Data Disk Space Auto Resolve Time", - "description": "Auto Resolve Time for the alert" - } - }, - "VMDataDiskSpacePolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "VM Data Disk Space Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" - } - }, - "VMDataDiskSpaceAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "VM Data Disk Space Alert State", - "description": "Alert state for the alert, true will enable the alert, false will disable the alert" - } - }, - "VMDataDiskSpaceThreshold": { - "type": "string", - "defaultValue": "10", - "metadata": { - "displayName": "VM Data Disk Space Threshold", - "description": "Threshold for the alert" - } - }, - "VMDataDiskSpaceOperator": { - "type": "string", - "defaultValue": "LessThan", - "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" - ], - "metadata": { - "displayName": "VM Data Disk Space Operator", - "description": "Operator for the alert" - } - }, - "VMDataDiskSpaceTimeAggregation": { - "type": "string", - "defaultValue": "Average", - "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" - ], - "metadata": { - "displayName": "VM Data Disk Space Time Aggregation", - "description": "Time Aggregation for the alert" - } - }, - "VMDataDiskSpaceEvaluationPeriods": { - "type": "string", - "defaultValue": "1", - "metadata": { - "displayName": "VM Data Disk Space Evaluation Periods", - "description": "Evaluation Periods for the alert" - } - }, - "VMDataDiskSpaceFailingPeriods": { - "type": "string", - "defaultValue": "1", - "metadata": { - "displayName": "VM Data Disk Space Failing Periods", - "description": "Failing Periods for the alert" - } - }, - "VMDataDiskSpaceDisksToInclude": { - "type": "array", - "defaultValue": [ - "*" - ], - "metadata": { - "displayName": "VM Data Disk Space Disks To Include", - "description": "Disks To Include for the alert" - } - }, - "VMDataDiskReadLatencyAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "VM Data Disk Read Latency Alert Severity", - "description": "Severity of the alert for VM Data Disk Read Latency" - } - }, - "VMDataDiskReadLatencyWindowSize": { - "type": "string", - "defaultValue": "PT15M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "VM Data Disk Read Latency Window Size", - "description": "Window size for the alert" - } - }, - "VMDataDiskReadLatencyEvaluationFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "VM Data Disk Read Latency Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "VMDataDiskReadLatencyAutoMitigate": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "VM Data Disk Read Latency Auto Mitigate", - "description": "Auto Mitigate for the alert" - } - }, - "VMDataDiskReadLatencyAutoResolve": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "VM Data Disk Read Latency Auto Resolve", - "description": "Auto Resolve for the alert" - } - }, - "VMDataDiskReadLatencyAutoResolveTime": { - "type": "string", - "defaultValue": "00:10:00", - "metadata": { - "displayName": "VM Data Disk Read Latency Auto Resolve Time", - "description": "Auto Resolve Time for the alert" - } - }, - "VMDataDiskReadLatencyPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "VM Data Disk Read Latency Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" - } - }, - "VMDataDiskReadLatencyAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "VM Data Disk Read Latency Alert State", - "description": "Alert state for the alert, true will enable the alert, false will disable the alert" - } - }, - "VMDataDiskReadLatencyThreshold": { - "type": "string", - "defaultValue": "30", - "metadata": { - "displayName": "VM Data Disk Read Latency Threshold", - "description": "Threshold for the alert" - } - }, - "VMDataDiskReadLatencyOperator": { - "type": "string", - "defaultValue": "GreaterThan", - "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" - ], - "metadata": { - "displayName": "VM Data Disk Read Latency Operator", - "description": "Operator for the alert" - } - }, - "VMDataDiskReadLatencyTimeAggregation": { - "type": "string", - "defaultValue": "Average", - "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" - ], - "metadata": { - "displayName": "VM Data Disk Read Latency Time Aggregation", - "description": "Time Aggregation for the alert" - } - }, - "VMDataDiskReadLatencyEvaluationPeriods": { - "type": "string", - "defaultValue": "1", - "metadata": { - "displayName": "VM Data Disk Read Latency Evaluation Periods", - "description": "Evaluation Periods for the alert" - } - }, - "VMDataDiskReadLatencyFailingPeriods": { - "type": "string", - "defaultValue": "1", - "metadata": { - "displayName": "VM Data Disk Read Latency Failing Periods", - "description": "Failing Periods for the alert" - } - }, - "VMDataDiskReadLatencyComputersToInclude": { - "type": "array", - "defaultValue": [ - "*" - ], - "metadata": { - "displayName": "VM Data Disk Read Latency Computers To Include", - "description": "Computers To Include for the alert" - } - }, - "VMDataDiskReadLatencyDisksToInclude": { - "type": "array", - "defaultValue": [ - "*" - ], - "metadata": { - "displayName": "VM Data Disk Read Latency Disks To Include", - "description": "Disks To Include for the alert" - } - }, - "VMDataDiskWriteLatencyAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "VM Data Disk Write Latency Alert Severity", - "description": "Severity of the alert for VM Data Disk Write Latency" - } - }, - "VMDataDiskWriteLatencyWindowSize": { - "type": "string", - "defaultValue": "PT15M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "VM Data Disk Write Latency Window Size", - "description": "Window size for the alert" - } - }, - "VMDataDiskWriteLatencyEvaluationFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "VM Data Disk Write Latency Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "VMDataDiskWriteLatencyAutoMitigate": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "VM Data Disk Write Latency Auto Mitigate", - "description": "Auto Mitigate for the alert" - } - }, - "VMDataDiskWriteLatencyAutoResolve": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "VM Data Disk Write Latency Auto Resolve", - "description": "Auto Resolve for the alert" - } - }, - "VMDataDiskWriteLatencyAutoResolveTime": { - "type": "string", - "defaultValue": "00:10:00", - "metadata": { - "displayName": "VM Data Disk Write Latency Auto Resolve Time", - "description": "Auto Resolve Time for the alert" - } - }, - "VMDataDiskWriteLatencyPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "VM Data Disk Write Latency Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" - } - }, - "VMDataDiskWriteLatencyAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "VM Data Disk Write Latency Alert State", - "description": "Alert state for the alert, true will enable the alert, false will disable the alert" - } - }, - "VMDataDiskWriteLatencyThreshold": { - "type": "string", - "defaultValue": "30", - "metadata": { - "displayName": "VM Data Disk Write Latency Threshold", - "description": "Threshold for the alert" - } - }, - "VMDataDiskWriteLatencyOperator": { - "type": "string", - "defaultValue": "GreaterThan", - "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" - ], - "metadata": { - "displayName": "VM Data Disk Write Latency Operator", - "description": "Operator for the alert" - } - }, - "VMDataDiskWriteLatencyTimeAggregation": { - "type": "string", - "defaultValue": "Average", - "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" - ], - "metadata": { - "displayName": "VM Data Disk Write Latency Time Aggregation", - "description": "Time Aggregation for the alert" - } - }, - "VMDataDiskWriteLatencyEvaluationPeriods": { - "type": "string", - "defaultValue": "1", - "metadata": { - "displayName": "VM Data Disk Write Latency Evaluation Periods", - "description": "Evaluation Periods for the alert" - } - }, - "VMDataDiskWriteLatencyFailingPeriods": { - "type": "string", - "defaultValue": "1", - "metadata": { - "displayName": "VM Data Disk Write Latency Failing Periods", - "description": "Failing Periods for the alert" - } - }, - "VMDataDiskWriteLatencyComputersToInclude": { - "type": "array", - "defaultValue": [ - "*" - ], - "metadata": { - "displayName": "VM Data Disk Write Latency Computers To Include", - "description": "Computers To Include for the alert" - } - }, - "VMDataDiskWriteLatencyDisksToInclude": { - "type": "array", - "defaultValue": [ - "*" - ], - "metadata": { - "displayName": "VM Data Disk Write Latency Disks To Include", - "description": "Disks To Include for the alert" - } - }, - "AGWApplicationGatewayTotalTimeAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "AGW Total Time Alert Severity", - "description": "Severity of the alert" - } - }, - "AGWApplicationGatewayTotalTimeAlertSensitivity": { - "type": "String", - "defaultValue": "Medium", - "allowedValues": [ - "Low", - "Medium", - "High" - ], - "metadata": { - "displayName": "AGW Total Time Dynamic Alert Sensitivity", - "description": "Dynamic Sensitivity of the alert" - } - }, - "AGWApplicationGatewayTotalTimeWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "AGW Total Time Window Size", - "description": "Window size for the alert" - } - }, - "AGWApplicationGatewayTotalTimeEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "AGW Total Time Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "AGWApplicationGatewayTotalTimePolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "AGW Total Time Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "AGWApplicationGatewayTotalTimeAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "AGW Total Time Alert State", - "description": "Alert state for the alert" - } - }, - "AGWBackendLastByteResponseTimeAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "AGW Backend Last Byte Response Time Alert Severity", - "description": "Severity of the alert" - } - }, - "AGWBackendLastByteResponseTimeAlertSensitivity": { - "type": "String", - "defaultValue": "Medium", - "allowedValues": [ - "Low", - "Medium", - "High" - ], - "metadata": { - "displayName": "AGW Backend Last Byte Response Time Dynamic Alert Sensitivity", - "description": "Dynamic Severity of the alert" - } - }, - "AGWBackendLastByteResponseTimeWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "AGW Backend Last Byte Response Time Window Size", - "description": "Window size for the alert" - } - }, - "AGWBackendLastByteResponseTimeEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "AGW Backend Last Byte Response Time Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "AGWBackendLastByteResponseTimePolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "AGW Backend Last Byte Response Time Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "AGWBackendLastByteResponseTimeAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "AGW Backend Last Byte Response Time Alert State", - "description": "Alert state for the alert" - } - }, - "AGWCapacityUnitsAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "AGW Capacity Units Alert Severity", - "description": "Severity of the alert" - } - }, - "AGWCapacityUnitsWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "AGW Capacity Units Window Size", - "description": "Window size for the alert" - } - }, - "AGWCapacityUnitsEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "AGW Capacity Units Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "AGWCapacityUnitsPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "AGW Capacity Units Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "AGWCapacityUnitsAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "AGW Capacity Units Alert State", - "description": "Alert state for the alert" - } - }, - "AGWComputeUnitsAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "AGW Compute Units Alert Severity", - "description": "Severity of the alert" - } - }, - "AGWComputeUnitsWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "AGW Compute Units Window Size", - "description": "Window size for the alert" - } - }, - "AGWComputeUnitsEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "AGW Compute Units Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "AGWComputeUnitsPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "AGW Compute Units Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "AGWComputeUnitsAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "AGW Compute Units Alert State", - "description": "Alert state for the alert" - } - }, - "AGWCPUUtilAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "AGW CPU Util Alert Severity", - "description": "Severity of the alert" - } - }, - "AGWCPUUtilWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "AGW CPU Util Window Size", - "description": "Window size for the alert" - } - }, - "AGWCPUUtilEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "AGW CPU Util Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "AGWCPUUtilPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "AGW CPU Util Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "AGWCPUUtilAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "AGW CPU Util Alert State", - "description": "Alert state for the alert" - } - }, - "AGWFailedRequestsAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "AGW Failed Requests Alert Severity", - "description": "Severity of the alert" - } - }, - "AGWFailedRequestsAlertSensitivity": { - "type": "String", - "defaultValue": "Medium", - "allowedValues": [ - "Low", - "Medium", - "High" - ], - "metadata": { - "displayName": "AGW Failed Requests Dynamic Alert Sensitivity", - "description": "Dynamic Sensitivity of the alert" - } - }, - "AGWFailedRequestsWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "AGW Failed Requests Window Size", - "description": "Window size for the alert" - } - }, - "AGWFailedRequestsEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "AGW Failed Requests Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "AGWFailedRequestsPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "AGW Failed Requests Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "AGWFailedRequestsAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "AGW Failed Requests Alert State", - "description": "Alert state for the alert" - } - }, - "AGWResponseStatusAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "AGW Response Status Alert Severity", - "description": "Severity of the alert" - } - }, - "AGWResponseStatusAlertSensitivity": { - "type": "String", - "defaultValue": "Medium", - "allowedValues": [ - "Low", - "Medium", - "High" - ], - "metadata": { - "displayName": "AGW Response Status Dynamic Alert Sensitivity", - "description": "Dynamic Sensitivity of the alert" - } - }, - "AGWResponseStatusWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "AGW Response Status Window Size", - "description": "Window size for the alert" - } - }, - "AGWResponseStatusEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "AGW Response Status Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "AGWResponseStatusPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "AGW Response Status Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "AGWResponseStatusAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "AGW Response Status Alert State", - "description": "Alert state for the alert" - } - }, - "AGWUnhealthyHostCountAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "AGW Unhealthy Host Count Alert Severity", - "description": "Severity of the alert" - } - }, - "AGWUnhealthyHostCountWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "AGW Unhealthy Host Count Window Size", - "description": "Window size for the alert" - } - }, - "AGWUnhealthyHostCountEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "AGW Unhealthy Host Count Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "AGWUnhealthyHostCountPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "AGW Unhealthy Host Count Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "AGWUnhealthyHostCountAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "AGW Unhealthy Host Count Alert State", - "description": "Alert state for the alert" - } - }, - "LBDatapathAvailabilityAlertSeverity": { - "type": "String", - "defaultValue": "0", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "LB Data path Availability Alert Severity", - "description": "Severity of the alert" - } - }, - "LBDatapathAvailabilityWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "LB Data path Availability Window Size", - "description": "Window size for the alert" - } - }, - "LBDatapathAvailabilityEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "LB Data path Availability Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "LBDatapathAvailabilityPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "LB Data path Availability Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "LBDatapathAvailabilityAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "LB Data path Availability Alert State", - "description": "Alert state for the alert" - } - }, - "LBGlobalBackendAvailabilityAlertSeverity": { - "type": "String", - "defaultValue": "0", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "LB Global Backend Availability Alert Severity", - "description": "Severity of the alert" - } - }, - "LBGlobalBackendAvailabilityWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "LB Global Backend Availability Window Size", - "description": "Window size for the alert" - } - }, - "LBGlobalBackendAvailabilityEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "LB Global Backend Availability Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "LBGlobalBackendAvailabilityPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "LB Global Backend Availability Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "LBGlobalBackendAvailabilityAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "LB Global Backend Availability Alert State", - "description": "Alert state for the alert" - } - }, - "LBHealthProbeStatusAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "LB Health Probe Status Alert Severity", - "description": "Severity of the alert" - } - }, - "LBHealthProbeStatusWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "LB Health Probe Status Window Size", - "description": "Window size for the alert" - } - }, - "LBHealthProbeStatusEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "LB Health Probe Status Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "LBHealthProbeStatusPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "LB Health Probe Status Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "LBHealthProbeStatusAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "LB Health Probe Status Alert State", - "description": "Alert state for the alert" - } - }, - "LBUsedSNATPortsAlertSeverity": { - "type": "String", - "defaultValue": "1", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "LB Used SNAT Ports Alert Severity", - "description": "Severity of the alert" - } - }, - "LBUsedSNATPortsWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "LB Used SNAT Ports Window Size", - "description": "Window size for the alert" - } - }, - "LBUsedSNATPortsEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "LB Used SNAT Ports Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "LBUsedSNATPortsPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "LB Used SNAT Ports Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "LBUsedSNATPortsAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "LB Used SNAT Ports Alert State", - "description": "Alert state for the alert" - } - }, - "CDNPOriginHealthPercentageAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "CDN Origin Health Percentage Alert Severity", - "description": "Severity of the alert" - } - }, - "CDNPOriginHealthPercentageWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "CDN Origin Health Percentage Window Size", - "description": "Window size for the alert" - } - }, - "CDNPOriginHealthPercentageEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "CDN Origin Health Percentage Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "CDNPOriginHealthPercentagePolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "CDN Origin Health Percentage Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "CDNPOriginHealthPercentageAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "CDN Origin Health Percentage Alert State", - "description": "Alert state for the alert" - } - }, - "CDNPOriginLatencyAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "CDN Origin Latancy Alert Severity", - "description": "Severity of the alert" - } - }, - "CDNPOriginLatencyWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "CDN Origin Latency Window Size", - "description": "Window size for the alert" - } - }, - "CDNPOriginLatencyEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "CDN Origin Latency Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "CDNPOriginLatencyPolicyEffect": { - "type": "string", - "defaultValue": "disabled", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "CDN Origin Latency Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "CDNPOriginLatencyAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "CDN Origin Latency Alert State", - "description": "Alert state for the alert" - } - }, - "CDNPPercentage4XXAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "CDN Percentage 4XX Alert Severity", - "description": "Severity of the alert" - } - }, - "CDNPPercentage4XXWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "CDN Percentage 4XX Window Size", - "description": "Window size for the alert" - } - }, - "CDNPPercentage4XXEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "CDN Percentage 4XX Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "CDNPPercentage4XXPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "CDN Percentage 4XX Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "CDNPPercentage4XXAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "CDN Percentage 4XX Alert State", - "description": "Alert state for the alert" - } - }, - "CDNPPercentage5XXAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "CDN Percentage 5XX Alert Severity", - "description": "Severity of the alert" - } - }, - "CDNPPercentage5XXWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "CDN Percentage 5XX Window Size", - "description": "Window size for the alert" - } - }, - "CDNPPercentage5XXEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "CDN Percentage 5XX Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "CDNPPercentage5XXPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "CDN Percentage 5XX Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "CDNPPercentage5XXAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "CDN Percentage 5XX Alert State", - "description": "Alert state for the alert" - } - }, - "TMEndpointHealthAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "TM Enpoint Health Alert Severity", - "description": "Severity of the alert" - } - }, - "TMEndpointHealthWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "TM Enpoint Health Window Size", - "description": "Window size for the alert" - } - }, - "TMEndpointHealthEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "TM Enpoint Health Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "TMEndpointHealthPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "TM Enpoint Health Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "TMEndpointHealthAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "TM Enpoint Health Alert State", - "description": "Alert state for the alert" - } - }, - "WSFCPUPercentageAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "WSF CPU Percentage Alert Severity", - "description": "Severity of the alert" - } - }, - "WSFCPUPercentageWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "WSF CPU Percentage Window Size", - "description": "Window size for the alert" - } - }, - "WSFCPUPercentageEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "WSF CPU Percentage Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "WSFCPUPercentagePolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "WSF CPU Percentage Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "WSFCPUPercentageAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "WSF CPU Percentage Alert State", - "description": "Alert state for the alert" - } - }, - "WSFMemoryPercentageAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "WSF Memory Percentage Alert Severity", - "description": "Severity of the alert" - } - }, - "WSFMemoryPercentageWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "WSF Memory Percentage Window Size", - "description": "Window size for the alert" - } - }, - "WSFMemoryPercentageEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "WSF Memory Percentage Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "WSFMemoryPercentagePolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "WSF Memory Percentage Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "WSFMemoryPercentageAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "WSF Memory Percentage Alert State", - "description": "Alert state for the alert" - } - }, - "WSFDiskQueueLengthAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "WSF Disk Queue Lenght Alert Severity", - "description": "Severity of the alert" - } - }, - "WSFDiskQueueLengthWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "WSF Disk Queue Lenght Window Size", - "description": "Window size for the alert" - } - }, - "WSFDiskQueueLengthEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "WSF Disk Queue Lenght Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "WSFDiskQueueLengthPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "WSF Disk Queue Lenght Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "WSFDiskQueueLengthAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "WSF Disk Queue Lenght Alert State", - "description": "Alert state for the alert" - } - }, - "WSFHttpQueueLengthAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "WSF HTTP Queue Lenght Alert Severity", - "description": "Severity of the alert" - } - }, - "WSFHttpQueueLengthWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "WSF HTTP Queue Lenght Window Size", - "description": "Window size for the alert" - } - }, - "WSFHttpQueueLengthEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "WSF HTTP Queue Lenght Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "WSFHttpQueueLengthPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "WSF HTTP Queue Lenght Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "WSFHttpQueueLengthAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "WSF HTTP Queue Lenght Alert State", - "description": "Alert state for the alert" - } - }, - "FDBackendHealthAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "FD Backend Health Alert Severity", - "description": "Severity of the alert" - } - }, - "FDBackendHealthWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "FD Backend Health Window Size", - "description": "Window size for the alert" - } - }, - "FDBackendHealthEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "FD Backend Health Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "FDBackendHealthPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "FD Backend Health Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "FDBackendHealthAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "FD Backend Health Alert State", - "description": "Alert state for the alert" - } - }, - "FDBackendRequestLatencyAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "FD Backend Request Latency Alert Severity", - "description": "Severity of the alert" - } - }, - "FDBackendRequestLatencyWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "FD Backend Request Latency Window Size", - "description": "Window size for the alert" - } - }, - "FDBackendRequestLatencyEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "FD Backend Request Latency Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "FDBackendRequestLatencyPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "FD Backend Request Latency Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" - } - }, - "FDBackendRequestLatencyAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "FD Backend Request Latency Alert State", - "description": "Alert state for the alert" - } - } - }, - "policyDefinitions": [ - { - "policyDefinitionReferenceId": "ALZ_KVRequest", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_KeyVault_Requests_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('KVRequestAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('KVRequestWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('KVRequestEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('KVRequestPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('KVRequestAlertState')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_KvAvailability", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_KeyVault_Availability_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('KvAvailabilityAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('KvAvailabilityWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('KvAvailabilityEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('KvAvailabilityPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('KvAvailabilityAlertState')]" - }, - "threshold": { - "value": "[[[parameters('KVAvailabilityThreshold')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_KvLatencyAvailability", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_KeyVault_Latency_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('KvLatencyAvailabilityAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('KvLatencyAvailabilityWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('KvLatencyAvailabilityEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('KvLatencyAvailabilityPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('KvLatencyAvailabilityAlertState')]" - }, - "threshold": { - "value": "[[[parameters('KvLatencyAvailabilityThreshold')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_KVCapacity", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_KeyVault_Capacity_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('KVCapacityAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('KVCapacityWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('KVCapacityEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('KVCapacityPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('KVCapacityAlertState')]" - }, - "threshold": { - "value": "[[[parameters('KVCapacityThreshold')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_activityKVDelete", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_KeyVault_Delete", - "parameters": { - "enabled": { - "value": "[[[parameters('activityKVDeleteAlertState')]" - }, - "alertResourceGroupName": { - "value": "[[[parameters('ALZMonitorResourceGroupName')]" - }, - "alertResourceGroupTags": { - "value": "[[[parameters('ALZMonitorResourceGroupTags')]" - }, - "alertResourceGroupLocation": { - "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_StorageAccountAvailability", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_StorageAccount_Availability_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('StorageAccountAvailabilityAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('StorageAccountAvailabilityWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('StorageAccountAvailabilityFrequency')]" - }, - "effect": { - "value": "[[[parameters('StorageAccountAvailabilityPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('StorageAccountAvailabilityAlertState')]" - }, - "threshold": { - "value": "[[[parameters('StorageAccountAvailabilityThreshold')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_activitySADelete", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_StorageAccount_Delete", - "parameters": { - "effect": { - "value": "[[[parameters('StorageAccountDeletePolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('StorageAccountDeleteAlertState')]" - }, - "alertResourceGroupName": { - "value": "[[[parameters('ALZMonitorResourceGroupName')]" - }, - "alertResourceGroupTags": { - "value": "[[[parameters('ALZMonitorResourceGroupTags')]" - }, - "alertResourceGroupLocation": { - "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_PIPBytesInDDoS", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_PublicIp_BytesInDDoSAttack_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('PIPBytesInDDoSAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('PIPBytesInDDoSWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('PIPBytesInDDoSEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('PIPBytesInDDoSPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('PIPBytesInDDoSAlertState')]" - }, - "threshold": { - "value": "[[[parameters('PIPBytesInDDoSThreshold')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_PIPDDoSAttack", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_PublicIp_DDoSAttack_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('PIPDDoSAttackAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('PIPDDoSAttackWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('PIPDDoSAttackEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('PIPDDoSAttackPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('PIPDDoSAttackAlertState')]" - }, - "threshold": { - "value": "[[[parameters('PIPDDoSAttackThreshold')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_PIPPacketsInDDoS", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_PublicIp_PacketsInDDoSAttack_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('PIPPacketsInDDoSAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('PIPPacketsInDDoSWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('PIPPacketsInDDoSEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('PIPPacketsInDDoSPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('PIPPacketsInDDoSAlertState')]" - }, - "threshold": { - "value": "[[[parameters('PIPPacketsInDDoSThreshold')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_PIPVIPAvailability", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_PublicIp_VIPAvailability_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('PIPVIPAvailabilityAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('PIPVIPAvailabilityWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('PIPVIPAvailabilityEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('PIPVIPAvailabilityPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('PIPVIPAvailabilityAlertState')]" - }, - "threshold": { - "value": "[[[parameters('PIPVIPAvailabilityThreshold')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_activityNSGDelete", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_NSG_Delete", - "parameters": { - "enabled": { - "value": "[[[parameters('activityNSGDeleteAlertState')]" - }, - "alertResourceGroupName": { - "value": "[[[parameters('ALZMonitorResourceGroupName')]" - }, - "alertResourceGroupTags": { - "value": "[[[parameters('ALZMonitorResourceGroupTags')]" - }, - "alertResourceGroupLocation": { - "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_activityUDRUpdate", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_RouteTable_Update", - "parameters": { - "enabled": { - "value": "[[[parameters('activityUDRUpdateAlertState')]" - }, - "alertResourceGroupName": { - "value": "[[[parameters('ALZMonitorResourceGroupName')]" - }, - "alertResourceGroupTags": { - "value": "[[[parameters('ALZMonitorResourceGroupTags')]" - }, - "alertResourceGroupLocation": { - "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_RVBackupHealthMonitor", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_RecoveryVault_BackupHealthMonitor_Alert", - "parameters": { - "effect": { - "value": "[[[parameters('RVBackupHealthMonitorPolicyEffect')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_VNETDDOSAttack", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VNET_DDoSAttack_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('VNETDDOSAttackAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('VNETDDOSAttackWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('VNETDDOSAttackEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('VNETDDOSAttackPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('VNETDDOSAttackAlertState')]" - }, - "threshold": { - "value": "[[[parameters('VNETDDOSAttackThreshold')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_VMHeartBeatRG", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VM_HeartBeat_Alert", - "parameters": { - "alertResourceGroupName": { - "value": "[[[parameters('ALZMonitorResourceGroupName')]" - }, - "alertResourceGroupTags": { - "value": "[[[parameters('ALZMonitorResourceGroupTags')]" - }, - "alertResourceGroupLocation": { - "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" - }, - "severity": { - "value": "[[[parameters('VMHeartBeatRGAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('VMHeartBeatRGWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('VMHeartBeatRGEvaluationFrequency')]" - }, - "autoMitigate": { - "value": "[[[parameters('VMHeartBeatRGAutoMitigate')]" - }, - "autoResolve": { - "value": "[[[parameters('VMHeartBeatRGAutoResolve')]" - }, - "autoResolveTime": { - "value": "[[[parameters('VMHeartBeatRGAutoResolveTime')]" - }, - "effect": { - "value": "[[[parameters('VMHeartBeatRGPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('VMHeartBeatRGAlertState')]" - }, - "threshold": { - "value": "[[[parameters('VMHeartBeatRGThreshold')]" - }, - "operator": { - "value": "[[[parameters('VMHeartBeatRGOperator')]" - }, - "timeAggregation": { - "value": "[[[parameters('VMHeartBeatRGTimeAggregation')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_VMNetworkIn", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VM_NetworkIn_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('VMNetworkInAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('VMNetworkInWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('VMNetworkInEvaluationFrequency')]" - }, - "autoMitigate": { - "value": "[[[parameters('VMNetworkInAutoMitigate')]" - }, - "autoResolve": { - "value": "[[[parameters('VMNetworkInAutoResolve')]" - }, - "autoResolveTime": { - "value": "[[[parameters('VMNetworkInAutoResolveTime')]" - }, - "effect": { - "value": "[[[parameters('VMNetworkInPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('VMNetworkInAlertState')]" - }, - "threshold": { - "value": "[[[parameters('VMNetworkInThreshold')]" - }, - "operator": { - "value": "[[[parameters('VMNetworkInOperator')]" - }, - "timeAggregation": { - "value": "[[[parameters('VMNetworkInTimeAggregation')]" - }, - "failingPeriods": { - "value": "[[[parameters('VMNetworkInFailingPeriods')]" - }, - "evaluationPeriods": { - "value": "[[[parameters('VMNetworkInEvaluationPeriods')]" - }, - "computersToInclude": { - "value": "[[[parameters('VMNetworkInComputersToInclude')]" - }, - "networkInterfacesToInclude": { - "value": "[[[parameters('VMNetworkInNetworkInterfaceToInclude')]" - }, - "alertResourceGroupName": { - "value": "[[[parameters('ALZMonitorResourceGroupName')]" - }, - "alertResourceGroupTags": { - "value": "[[[parameters('ALZMonitorResourceGroupTags')]" - }, - "alertResourceGroupLocation": { - "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_VMNetworkOut", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VM_NetworkOut_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('VMNetworkOutAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('VMNetworkOutWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('VMNetworkOutEvaluationFrequency')]" - }, - "autoMitigate": { - "value": "[[[parameters('VMNetworkOutAutoMitigate')]" - }, - "autoResolve": { - "value": "[[[parameters('VMNetworkOutAutoResolve')]" - }, - "autoResolveTime": { - "value": "[[[parameters('VMNetworkOutAutoResolveTime')]" - }, - "effect": { - "value": "[[[parameters('VMNetworkOutPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('VMNetworkOutAlertState')]" - }, - "threshold": { - "value": "[[[parameters('VMNetworkOutThreshold')]" - }, - "operator": { - "value": "[[[parameters('VMNetworkOutOperator')]" - }, - "timeAggregation": { - "value": "[[[parameters('VMNetworkOutTimeAggregation')]" - }, - "failingPeriods": { - "value": "[[[parameters('VMNetworkOutFailingPeriods')]" - }, - "evaluationPeriods": { - "value": "[[[parameters('VMNetworkOutEvaluationPeriods')]" - }, - "computersToInclude": { - "value": "[[[parameters('VMNetworkOutComputersToInclude')]" - }, - "networkInterfacesToInclude": { - "value": "[[[parameters('VMNetworkOutNetworkInterfaceToInclude')]" - }, - "alertResourceGroupName": { - "value": "[[[parameters('ALZMonitorResourceGroupName')]" - }, - "alertResourceGroupTags": { - "value": "[[[parameters('ALZMonitorResourceGroupTags')]" - }, - "alertResourceGroupLocation": { - "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_VMOSDiskReadLatency", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VM_OSDiskreadLatency_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('VMOSDiskReadLatencyAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('VMOSDiskReadLatencyWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('VMOSDiskReadLatencyEvaluationFrequency')]" - }, - "autoMitigate": { - "value": "[[[parameters('VMOSDiskReadLatencyAutoMitigate')]" - }, - "autoResolve": { - "value": "[[[parameters('VMOSDiskReadLatencyAutoResolve')]" - }, - "autoResolveTime": { - "value": "[[[parameters('VMOSDiskReadLatencyAutoResolveTime')]" - }, - "effect": { - "value": "[[[parameters('VMOSDiskReadLatencyPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('VMOSDiskReadLatencyAlertState')]" - }, - "threshold": { - "value": "[[[parameters('VMOSDiskReadLatencyThreshold')]" - }, - "operator": { - "value": "[[[parameters('VMOSDiskReadLatencyOperator')]" - }, - "timeAggregation": { - "value": "[[[parameters('VMOSDiskReadLatencyTimeAggregation')]" - }, - "failingPeriods": { - "value": "[[[parameters('VMOSDiskReadLatencyFailingPeriods')]" - }, - "evaluationPeriods": { - "value": "[[[parameters('VMOSDiskReadLatencyEvaluationPeriods')]" - }, - "computersToInclude": { - "value": "[[[parameters('VMOSDiskReadLatencyComputersToInclude')]" - }, - "disksToInclude": { - "value": "[[[parameters('VMOSDiskReadLatencyDisksToInclude')]" - }, - "alertResourceGroupName": { - "value": "[[[parameters('ALZMonitorResourceGroupName')]" - }, - "alertResourceGroupTags": { - "value": "[[[parameters('ALZMonitorResourceGroupTags')]" - }, - "alertResourceGroupLocation": { - "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_VMOSDiskWriteLatency", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VM_OSDiskwriteLatency_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('VMOSDiskWriteLatencyAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('VMOSDiskWriteLatencyWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('VMOSDiskWriteLatencyEvaluationFrequency')]" - }, - "autoMitigate": { - "value": "[[[parameters('VMOSDiskWriteLatencyAutoMitigate')]" - }, - "autoResolve": { - "value": "[[[parameters('VMOSDiskWriteLatencyAutoResolve')]" - }, - "autoResolveTime": { - "value": "[[[parameters('VMOSDiskWriteLatencyAutoResolveTime')]" - }, - "effect": { - "value": "[[[parameters('VMOSDiskWriteLatencyPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('VMOSDiskWriteLatencyAlertState')]" - }, - "threshold": { - "value": "[[[parameters('VMOSDiskWriteLatencyThreshold')]" - }, - "operator": { - "value": "[[[parameters('VMOSDiskWriteLatencyOperator')]" - }, - "timeAggregation": { - "value": "[[[parameters('VMOSDiskWriteLatencyTimeAggregation')]" - }, - "failingPeriods": { - "value": "[[[parameters('VMOSDiskWriteLatencyFailingPeriods')]" - }, - "evaluationPeriods": { - "value": "[[[parameters('VMOSDiskWriteLatencyEvaluationPeriods')]" - }, - "computersToInclude": { - "value": "[[[parameters('VMOSDiskWriteLatencyComputersToInclude')]" - }, - "disksToInclude": { - "value": "[[[parameters('VMOSDiskWriteLatencyDisksToInclude')]" - }, - "alertResourceGroupName": { - "value": "[[[parameters('ALZMonitorResourceGroupName')]" - }, - "alertResourceGroupTags": { - "value": "[[[parameters('ALZMonitorResourceGroupTags')]" - }, - "alertResourceGroupLocation": { - "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_VMOSDiskSpace", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VM_OSDiskSpace_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('VMOSDiskSpaceAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('VMOSDiskSpaceWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('VMOSDiskSpaceEvaluationFrequency')]" - }, - "autoMitigate": { - "value": "[[[parameters('VMOSDiskSpaceAutoMitigate')]" - }, - "autoResolve": { - "value": "[[[parameters('VMOSDiskSpaceAutoResolve')]" - }, - "autoResolveTime": { - "value": "[[[parameters('VMOSDiskSpaceAutoResolveTime')]" - }, - "effect": { - "value": "[[[parameters('VMOSDiskSpacePolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('VMOSDiskSpaceAlertState')]" - }, - "threshold": { - "value": "[[[parameters('VMOSDiskSpaceThreshold')]" - }, - "operator": { - "value": "[[[parameters('VMOSDiskSpaceOperator')]" - }, - "timeAggregation": { - "value": "[[[parameters('VMOSDiskSpaceTimeAggregation')]" - }, - "failingPeriods": { - "value": "[[[parameters('VMOSDiskSpaceFailingPeriods')]" - }, - "evaluationPeriods": { - "value": "[[[parameters('VMOSDiskSpaceEvaluationPeriods')]" - }, - "computersToInclude": { - "value": "[[[parameters('VMOSDiskSpaceComputersToInclude')]" - }, - "disksToInclude": { - "value": "[[[parameters('VMOSDiskSpaceDisksToInclude')]" - }, - "alertResourceGroupName": { - "value": "[[[parameters('ALZMonitorResourceGroupName')]" - }, - "alertResourceGroupTags": { - "value": "[[[parameters('ALZMonitorResourceGroupTags')]" - }, - "alertResourceGroupLocation": { - "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_VMPercentCPU", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VM_CPU_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('VMPercentCPUAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('VMPercentCPUWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('VMPercentCPUEvaluationFrequency')]" - }, - "autoMitigate": { - "value": "[[[parameters('VMPercentCPUAutoMitigate')]" - }, - "autoResolve": { - "value": "[[[parameters('VMPercentCPUAutoResolve')]" - }, - "autoResolveTime": { - "value": "[[[parameters('VMPercentCPUAutoResolveTime')]" - }, - "effect": { - "value": "[[[parameters('VMPercentCPUPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('VMPercentCPUAlertState')]" - }, - "threshold": { - "value": "[[[parameters('VMPercentCPUThreshold')]" - }, - "operator": { - "value": "[[[parameters('VMPercentCPUOperator')]" - }, - "timeAggregation": { - "value": "[[[parameters('VMPercentCPUTimeAggregation')]" - }, - "alertResourceGroupName": { - "value": "[[[parameters('ALZMonitorResourceGroupName')]" - }, - "alertResourceGroupTags": { - "value": "[[[parameters('ALZMonitorResourceGroupTags')]" - }, - "alertResourceGroupLocation": { - "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_VMPercentMemory", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VM_Memory_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('VMPercentMemoryAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('VMPercentMemoryWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('VMPercentMemoryEvaluationFrequency')]" - }, - "autoMitigate": { - "value": "[[[parameters('VMPercentMemoryAutoMitigate')]" - }, - "autoResolve": { - "value": "[[[parameters('VMPercentMemoryAutoResolve')]" - }, - "autoResolveTime": { - "value": "[[[parameters('VMPercentMemoryAutoResolveTime')]" - }, - "effect": { - "value": "[[[parameters('VMPercentMemoryPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('VMPercentMemoryAlertState')]" - }, - "threshold": { - "value": "[[[parameters('VMPercentMemoryThreshold')]" - }, - "operator": { - "value": "[[[parameters('VMPercentMemoryOperator')]" - }, - "timeAggregation": { - "value": "[[[parameters('VMPercentMemoryTimeAggregation')]" - }, - "alertResourceGroupName": { - "value": "[[[parameters('ALZMonitorResourceGroupName')]" - }, - "alertResourceGroupTags": { - "value": "[[[parameters('ALZMonitorResourceGroupTags')]" - }, - "alertResourceGroupLocation": { - "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_VMDataDiskSpace", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VM_dataDiskSpace_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('VMDataDiskSpaceAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('VMDataDiskSpaceWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('VMDataDiskSpaceEvaluationFrequency')]" - }, - "autoMitigate": { - "value": "[[[parameters('VMDataDiskSpaceAutoMitigate')]" - }, - "autoResolve": { - "value": "[[[parameters('VMDataDiskSpaceAutoResolve')]" - }, - "autoResolveTime": { - "value": "[[[parameters('VMDataDiskSpaceAutoResolveTime')]" - }, - "effect": { - "value": "[[[parameters('VMDataDiskSpacePolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('VMDataDiskSpaceAlertState')]" - }, - "threshold": { - "value": "[[[parameters('VMDataDiskSpaceThreshold')]" - }, - "operator": { - "value": "[[[parameters('VMDataDiskSpaceOperator')]" - }, - "timeAggregation": { - "value": "[[[parameters('VMDataDiskSpaceTimeAggregation')]" - }, - "failingPeriods": { - "value": "[[[parameters('VMDataDiskSpaceFailingPeriods')]" - }, - "evaluationPeriods": { - "value": "[[[parameters('VMDataDiskSpaceEvaluationPeriods')]" - }, - "disksToInclude": { - "value": "[[[parameters('VMDataDiskSpaceDisksToInclude')]" - }, - "alertResourceGroupName": { - "value": "[[[parameters('ALZMonitorResourceGroupName')]" - }, - "alertResourceGroupTags": { - "value": "[[[parameters('ALZMonitorResourceGroupTags')]" - }, - "alertResourceGroupLocation": { - "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_VMDataDiskReadLatency", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VM_dataDiskReadLatency_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('VMDataDiskReadLatencyAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('VMDataDiskReadLatencyWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('VMDataDiskReadLatencyEvaluationFrequency')]" - }, - "autoMitigate": { - "value": "[[[parameters('VMDataDiskReadLatencyAutoMitigate')]" - }, - "autoResolve": { - "value": "[[[parameters('VMDataDiskReadLatencyAutoResolve')]" - }, - "autoResolveTime": { - "value": "[[[parameters('VMDataDiskReadLatencyAutoResolveTime')]" - }, - "effect": { - "value": "[[[parameters('VMDataDiskReadLatencyPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('VMDataDiskReadLatencyAlertState')]" - }, - "threshold": { - "value": "[[[parameters('VMDataDiskReadLatencyThreshold')]" - }, - "operator": { - "value": "[[[parameters('VMDataDiskReadLatencyOperator')]" - }, - "timeAggregation": { - "value": "[[[parameters('VMDataDiskReadLatencyTimeAggregation')]" - }, - "failingPeriods": { - "value": "[[[parameters('VMDataDiskReadLatencyFailingPeriods')]" - }, - "evaluationPeriods": { - "value": "[[[parameters('VMDataDiskReadLatencyEvaluationPeriods')]" - }, - "computersToInclude": { - "value": "[[[parameters('VMDataDiskReadLatencyComputersToInclude')]" - }, - "disksToInclude": { - "value": "[[[parameters('VMDataDiskReadLatencyDisksToInclude')]" - }, - "alertResourceGroupName": { - "value": "[[[parameters('ALZMonitorResourceGroupName')]" - }, - "alertResourceGroupTags": { - "value": "[[[parameters('ALZMonitorResourceGroupTags')]" - }, - "alertResourceGroupLocation": { - "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_VMDataDiskWriteLatency", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VM_dataDiskWriteLatency_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('VMDataDiskWriteLatencyAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('VMDataDiskWriteLatencyWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('VMDataDiskWriteLatencyEvaluationFrequency')]" - }, - "autoMitigate": { - "value": "[[[parameters('VMDataDiskWriteLatencyAutoMitigate')]" - }, - "autoResolve": { - "value": "[[[parameters('VMDataDiskWriteLatencyAutoResolve')]" - }, - "autoResolveTime": { - "value": "[[[parameters('VMDataDiskWriteLatencyAutoResolveTime')]" - }, - "effect": { - "value": "[[[parameters('VMDataDiskWriteLatencyPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('VMDataDiskWriteLatencyAlertState')]" - }, - "threshold": { - "value": "[[[parameters('VMDataDiskWriteLatencyThreshold')]" - }, - "operator": { - "value": "[[[parameters('VMDataDiskWriteLatencyOperator')]" - }, - "timeAggregation": { - "value": "[[[parameters('VMDataDiskWriteLatencyTimeAggregation')]" - }, - "failingPeriods": { - "value": "[[[parameters('VMDataDiskWriteLatencyFailingPeriods')]" - }, - "evaluationPeriods": { - "value": "[[[parameters('VMDataDiskWriteLatencyEvaluationPeriods')]" - }, - "computersToInclude": { - "value": "[[[parameters('VMDataDiskWriteLatencyComputersToInclude')]" - }, - "disksToInclude": { - "value": "[[[parameters('VMDataDiskWriteLatencyDisksToInclude')]" - }, - "alertResourceGroupName": { - "value": "[[[parameters('ALZMonitorResourceGroupName')]" - }, - "alertResourceGroupTags": { - "value": "[[[parameters('ALZMonitorResourceGroupTags')]" - }, - "alertResourceGroupLocation": { - "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_AGWTotalTime", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_AG_ApplicationGatewayTotalTime_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('AGWApplicationGatewayTotalTimeAlertSeverity')]" - }, - "alertSensitivity": { - "value": "[[[parameters('AGWApplicationGatewayTotalTimeAlertSensitivity')]" - }, - "windowSize": { - "value": "[[[parameters('AGWApplicationGatewayTotalTimeWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('AGWApplicationGatewayTotalTimeEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('AGWApplicationGatewayTotalTimePolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('AGWApplicationGatewayTotalTimeAlertState')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_AGWBackendLastByteResponseTime", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_AG_BackendLastByteResponseTime_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('AGWBackendLastByteResponseTimeAlertSeverity')]" - }, - "alertSensitivity": { - "value": "[[[parameters('AGWBackendLastByteResponseTimeAlertSensitivity')]" - }, - "windowSize": { - "value": "[[[parameters('AGWBackendLastByteResponseTimeWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('AGWBackendLastByteResponseTimeEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('AGWBackendLastByteResponseTimePolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('AGWBackendLastByteResponseTimeAlertState')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_AGWCapacityUnits", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_AG_CapacityUnits_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('AGWCapacityUnitsAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('AGWCapacityUnitsWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('AGWCapacityUnitsEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('AGWCapacityUnitsPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('AGWCapacityUnitsAlertState')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_AGWComputeUnits", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_AG_ComputeUnits_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('AGWComputeUnitsAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('AGWComputeUnitsWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('AGWComputeUnitsEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('AGWComputeUnitsPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('AGWComputeUnitsAlertState')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_AGWCPUUtilization", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_AG_CPUUtilization_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('AGWCPUUtilAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('AGWCPUUtilWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('AGWCPUUtilEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('AGWCPUUtilPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('AGWCPUUtilAlertState')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_AGWFailedRequests", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_AG_FailedRequests_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('AGWFailedRequestsAlertSeverity')]" - }, - "alertSensitivity": { - "value": "[[[parameters('AGWFailedRequestsAlertSensitivity')]" - }, - "windowSize": { - "value": "[[[parameters('AGWFailedRequestsWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('AGWFailedRequestsEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('AGWFailedRequestsPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('AGWFailedRequestsAlertState')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_AGWResponseStatus", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_AG_ResponseStatus_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('AGWResponseStatusAlertSeverity')]" - }, - "alertSensitivity": { - "value": "[[[parameters('AGWResponseStatusAlertSensitivity')]" - }, - "windowSize": { - "value": "[[[parameters('AGWResponseStatusWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('AGWResponseStatusEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('AGWResponseStatusPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('AGWResponseStatusAlertState')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_AGWUnhealthyHostCount", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_AG_UnhealthyHostCount_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('AGWUnhealthyHostCountAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('AGWUnhealthyHostCountWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('AGWUnhealthyHostCountEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('AGWUnhealthyHostCountPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('AGWUnhealthyHostCountAlertState')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_LBDataPathAvailability", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ALB_DataPathAvailability_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('LBDataPathAvailabilityAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('LBDataPathAvailabilityWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('LBDataPathAvailabilityEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('LBDataPathAvailabilityPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('LBDataPathAvailabilityAlertState')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_LBGlobalBackendAvailability", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ALB_GlobalBackendAvailability_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('LBGlobalBackendAvailabilityAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('LBGlobalBackendAvailabilityWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('LBGlobalBackendAvailabilityEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('LBGlobalBackendAvailabilityPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('LBGlobalBackendAvailabilityAlertState')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_LBHealthProbeStatus", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ALB_HealthProbeStatus_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('LBHealthProbeStatusAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('LBHealthProbeStatusWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('LBHealthProbeStatusEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('LBHealthProbeStatusPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('LBHealthProbeStatusAlertState')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_LBUsedSNATPorts", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ALB_UsedSNATPorts_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('LBUsedSNATPortsAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('LBUsedSNATPortsWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('LBUsedSNATPortsEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('LBUsedSNATPortsPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('LBUsedSNATPortsAlertState')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_CDNPOriginHealthPercentage", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_FrontDoorCDN_OriginHealthPercentage_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('CDNPOriginHealthPercentageAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('CDNPOriginHealthPercentageWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('CDNPOriginHealthPercentageEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('CDNPOriginHealthPercentagePolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('CDNPOriginHealthPercentageAlertState')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_CDNPOriginLatency", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_FrontDoorCDN_OriginLatency_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('CDNPOriginLatencyAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('CDNPOriginLatencyWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('CDNPOriginLatencyEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('CDNPOriginLatencyPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('CDNPOriginLatencyAlertState')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_CDNPPercentage4XX", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_FrontDoorCDN_Percentage4XX_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('CDNPPercentage4XXAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('CDNPPercentage4XXWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('CDNPPercentage4XXEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('CDNPPercentage4XXPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('CDNPPercentage4XXAlertState')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_CDNPPercentage5XX", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_FrontDoorCDN_Percentage5XX_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('CDNPPercentage5XXAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('CDNPPercentage5XXWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('CDNPPercentage5XXEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('CDNPPercentage5XXPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('CDNPPercentage5XXAlertState')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_TMEndpointHealth", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_TM_EndpointHealth_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('TMEndpointHealthAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('TMEndpointHealthWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('TMEndpointHealthEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('TMEndpointHealthPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('TMEndpointHealthAlertState')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_WSFCPUPercentage", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_WSF_CPUPercentage_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('WSFCPUPercentageAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('WSFCPUPercentageWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('WSFCPUPercentageEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('WSFCPUPercentagePolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('WSFCPUPercentageAlertState')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_WSFMemoryPercentage", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_WSF_MemoryPercentage_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('WSFMemoryPercentageAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('WSFMemoryPercentageWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('WSFMemoryPercentageEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('WSFMemoryPercentagePolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('WSFMemoryPercentageAlertState')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_WSFDiskQueueLength", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_WSF_DiskQueueLength_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('WSFDiskQueueLengthAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('WSFDiskQueueLengthWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('WSFDiskQueueLengthEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('WSFDiskQueueLengthPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('WSFDiskQueueLengthAlertState')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_WSFHttpQueueLength", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_WSF_HttpQueueLength_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('WSFHttpQueueLengthAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('WSFHttpQueueLengthWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('WSFHttpQueueLengthEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('WSFHttpQueueLengthPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('WSFHttpQueueLengthAlertState')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_FDBackendHealth", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_FD_BackendHealth_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('FDBackendHealthAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('FDBackendHealthWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('FDBackendHealthEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('FDBackendHealthPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('FDBackendHealthAlertState')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_FDBackendRequestLatency", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_FD_BackendRequestLatency_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('FDBackendRequestLatencyAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('FDBackendRequestLatencyWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('FDBackendRequestLatencyEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('FDBackendRequestLatencyPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('FDBackendRequestLatencyAlertState')]" - } - } - } - ], - "policyType": "Custom", - "policyDefinitionGroups": null - } - }, - "$fxv#118": { - "type": "Microsoft.Authorization/policySetDefinitions", - "apiVersion": "2021-06-01", - "name": "Alerting-Management", - "properties": { - "displayName": "Deploy Azure Monitor Baseline Alerts for Management", - "description": "Initiative to deploy AMBA alerts relevant to the ALZ Management management group", - "metadata": { - "version": "1.0.3", - "category": "Monitoring", - "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", - "alzCloudEnvironments": [ - "AzureCloud" - ], - "_deployed_by_amba": true - }, - "parameters": { - "ALZMonitorResourceGroupName": { - "type": "String", - "defaultValue": "ALZ-Monitoring-RG", - "metadata": { - "displayName": "ALZ Monitoring Resource Group Name", - "description": "Name of the resource group to deploy the ALZ monitoring resources to" - } - }, - "ALZMonitorResourceGroupTags": { - "type": "Object", - "defaultValue": { - "_deployed_by_alz_monitor": true - }, - "metadata": { - "displayName": "ALZ Monitoring Resource Group Tags", - "description": "Tags to apply to the resource group" - } - }, - "ALZMonitorResourceGroupLocation": { - "type": "String", - "defaultValue": "centralus", - "metadata": { - "displayName": "ALZ Monitoring Resource Group Location", - "description": "Location of the resource group" - } - }, - "AATotalJobAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "AA Total Job Alert Severity", - "description": "Severity of the alert" - } - }, - "AATotalJobAlertWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "AA Total Job Alert Window Size", - "description": "Window size for the alert" - } - }, - "AATotalJobAlertEvaluationFrequency": { - "type": "string", - "defaultValue": "PT1M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "AA Total Job Alert Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "AATotalJobAlertPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "AA Total Job Alert Policy Effect", - "description": "Policy effect for the alert" - } - }, - "AATotalJobAlertAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "AA Total Job Alert State", - "description": "Alert state for the alert" - } - }, - "AATotalJobAlertThreshold": { - "type": "string", - "defaultValue": "20", - "metadata": { - "displayName": "AA Total Job Alert Threshold", - "description": "Threshold for the alert" - } - }, - "RVBackupHealthMonitorPolicyEffect": { - "type": "string", - "defaultValue": "modify", - "allowedValues": [ - "modify", - "audit", - "disabled" - ], - "metadata": { - "displayName": "RV Backup Health Monitor Policy Effect", - "description": "Policy effect for the alert, modify will create the alert if it does not exist and enable it on your Recovery Vaults, audit will only audit if alerting is enabled on Recovery Vaults, disabled will not create the alert on Recovery Vaults" - } - }, - "StorageAccountAvailabilityAlertSeverity": { - "type": "String", - "defaultValue": "1", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "Storage Account Availability Alert Severity", - "description": "Severity of the alert" - } - }, - "StorageAccountAvailabilityWindowSize": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "Storage Account Availability Alert Window Size", - "description": "Window size for the alert" - } - }, - "StorageAccountAvailabilityFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "Storage Account Availability Alert Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "StorageAccountAvailabilityPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "Storage Account Availability Alert Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will create the alert if it does not exist, disabled will not create the alert" - } - }, - "StorageAccountAvailabilityAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Storage Account Availability Alert State", - "description": "Alert state for the alert" - } - }, - "StorageAccountAvailabilityThreshold": { - "type": "string", - "defaultValue": "90", - "metadata": { - "displayName": "Storage Account Availability Alert Threshold", - "description": "Threshold for the alert" - } - }, - "StorageAccountDeletePolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "Storage Account Delete Alert Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will create the alert if it does not exist, disabled will not create the alert" - } - }, - "StorageAccountDeleteAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Storage Account Delete Alert State", - "description": "Alert state for the alert" - } - }, - "activityLAWDeleteAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Activity Log Alert Delete Alert State", - "description": "Alert state for the alert" - } - }, - "activityLAWKeyRegenAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Activity Log Alert Key Regen Alert State", - "description": "Alert state for the alert" - } - } - }, - "policyDefinitions": [ - { - "policyDefinitionReferenceId": "ALZ_activityLAWDelete", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_LAWorkspace_Delete", - "parameters": { - "enabled": { - "value": "[[[parameters('activityLAWDeleteAlertState')]" - }, - "alertResourceGroupName": { - "value": "[[[parameters('ALZMonitorResourceGroupName')]" - }, - "alertResourceGroupTags": { - "value": "[[[parameters('ALZMonitorResourceGroupTags')]" - }, - "alertResourceGroupLocation": { - "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_activityLAWKeyRegen", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_LAWorkspace_KeyRegen", - "parameters": { - "enabled": { - "value": "[[[parameters('activityLAWKeyRegenAlertState')]" - }, - "alertResourceGroupName": { - "value": "[[[parameters('ALZMonitorResourceGroupName')]" - }, - "alertResourceGroupTags": { - "value": "[[[parameters('ALZMonitorResourceGroupTags')]" - }, - "alertResourceGroupLocation": { - "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_AATotalJob", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_AA_TotalJob_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('AATotalJobAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('AATotalJobAlertWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('AATotalJobAlertEvaluationFrequency')]" - }, - "effect": { - "value": "[[[parameters('AATotalJobAlertPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('AATotalJobAlertAlertState')]" - }, - "threshold": { - "value": "[[[parameters('AATotalJobAlertThreshold')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_RVBackupHealth", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_RecoveryVault_BackupHealthMonitor_Alert", - "parameters": { - "effect": { - "value": "[[[parameters('RVBackupHealthMonitorPolicyEffect')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_StorageAccountAvailability", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_StorageAccount_Availability_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('StorageAccountAvailabilityAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('StorageAccountAvailabilityWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('StorageAccountAvailabilityFrequency')]" - }, - "effect": { - "value": "[[[parameters('StorageAccountAvailabilityPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('StorageAccountAvailabilityAlertState')]" - }, - "threshold": { - "value": "[[[parameters('StorageAccountAvailabilityThreshold')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_activitySADelete", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_StorageAccount_Delete", - "parameters": { - "effect": { - "value": "[[[parameters('StorageAccountDeletePolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('StorageAccountDeleteAlertState')]" - }, - "alertResourceGroupName": { - "value": "[[[parameters('ALZMonitorResourceGroupName')]" - }, - "alertResourceGroupTags": { - "value": "[[[parameters('ALZMonitorResourceGroupTags')]" - }, - "alertResourceGroupLocation": { - "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" - } - } - } - ], - "policyType": "Custom", - "policyDefinitionGroups": null - } - }, - "$fxv#119": { - "type": "Microsoft.Authorization/policySetDefinitions", - "apiVersion": "2021-06-01", - "name": "Alerting-ServiceHealth", - "properties": { - "displayName": "Deploy Azure Monitor Baseline Alerts for Service Health", - "description": "Initiative to deploy AMBA Service Health alerts to Azure services", - "metadata": { - "version": "1.4.0", - "category": "Monitoring", - "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", - "alzCloudEnvironments": [ - "AzureCloud" - ], - "_deployed_by_amba": true - }, - "parameters": { - "ALZMonitorResourceGroupName": { - "type": "String", - "defaultValue": "ALZ-Monitoring-RG", - "metadata": { - "displayName": "Resource Group Name", - "description": "Name of the resource group to deploy the alerts to" - } - }, - "ALZMonitorResourceGroupTags": { - "type": "Object", - "defaultValue": { - "_deployed_by_alz_monitor": true - }, - "metadata": { - "displayName": "Resource Group Tags", - "description": "Tags to apply to the resource group" - } - }, - "ALZMonitorResourceGroupLocation": { - "type": "String", - "defaultValue": "centralus", - "metadata": { - "displayName": "Resource Group Location", - "description": "Location of the resource group" - } - }, - "ResHlthUnhealthyAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Resource Health Unhealthy Alert State", - "description": "State of the Resource Health Unhealthy alert" - } - }, - "ResHlthUnhealthyPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "Resource Health Unhealthy Alert Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" - } - }, - "SvcHlthAdvisoryAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Service Health Advisory Alert State", - "description": "State of the Service Health Advisory alert" - } - }, - "serviceHealthAdvisoryPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "Service Health Advisory Alert Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" - } - }, - "SvcHlthIncidentAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Service Health Incident Alert State", - "description": "State of the Service Health Incident alert" - } - }, - "serviceHealthIncidentPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "Service Health Incident Alert Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" - } - }, - "SvcHlthMaintenanceAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Service Health Maintenance Alert State", - "description": "State of the Service Health Maintenance alert" - } - }, - "serviceHealthMaintenancePolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "Service Health Maintenance Alert Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" - } - }, - "svcHlthSecAdvisoryAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Service Health Security Advisory Alert State", - "description": "State of the Service Health Security Advisory alert" - } - }, - "serviceHealthSecurityPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "Service Health Security Advisory Alert Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" - } - }, - "MonitorDisable": { - "type": "string", - "defaultValue": "MonitorDisable", - "metadata": { - "displayName": "Monitoring disabled", - "description": "Tag name to disable monitoring. Set to true if monitoring should be disabled" - } - }, - "ALZMonitorActionGroupEmail": { - "type": "string", - "defaultValue": "", - "metadata": { - "displayName": "Action Group Email Addresses", - "description": "Email addresses to send alerts to" - } - }, - "ALZLogicappResourceId": { - "type": "String", - "defaultValue": "", - "metadata": { - "displayName": "Logic App Resource Id", - "description": "Logic App Resource Id for Action Group to send alerts to" - } - }, - "ALZLogicappCallbackUrl": { - "type": "String", - "metadata": { - "displayName": "Logic App Callback URL", - "description": "Callback URL that triggers the Logic App" - }, - "defaultValue": "" - }, - "ALZArmRoleId": { - "type": "String", - "defaultValue": "", - "metadata": { - "displayName": "Arm Role Id", - "description": "Arm Built-in Role Id for action group to send alerts to a subscription level, will only send to individual members of role" - } - }, - "ALZEventHubResourceId": { - "type": "String", - "defaultValue": "", - "metadata": { - "displayName": "Event Hub resource id", - "description": "Event Hub resource id for action group to send alerts to" - } - }, - "ALZWebhookServiceUri": { - "type": "String", - "metadata": { - "displayName": "Webhook Service Uri", - "description": "Indicates the service uri of the webhook to send alerts to" - }, - "defaultValue": "" - }, - "ALZFunctionResourceId": { - "type": "String", - "metadata": { - "displayName": "Function Resource Id", - "description": "Function Resource Id for Action Group to send alerts to" - }, - "defaultValue": "" - }, - "ALZFunctionTriggerUrl": { - "type": "String", - "metadata": { - "displayName": "Function Trigger URL", - "description": "URL that triggers the Function App" - }, - "defaultValue": "" - }, - "BYOActionGroup": { - "type": "String", - "metadata": { - "displayName": "Customer defined Action Group Resource ID", - "description": "The Resource ID of an existing Action Group already deployed by the customer in his environment" - }, - "defaultValue": "" - }, - "BYOAlertProcessingRule": { - "type": "String", - "metadata": { - "displayName": "Customer defined Alert Processing Rule Resource ID", - "description": "The Resource ID of an existing Alert Processing Rule already deployed by the customer in his environment" - }, - "defaultValue": "" - } - }, - "policyDefinitions": [ - { - "policyDefinitionReferenceId": "ALZ_ServiceHealth_ActionGroups", - "policyDefinitionId": "[[concat('/providers/Microsoft.Management/managementGroups/contoso', '/providers/Microsoft.Authorization/policyDefinitions/Deploy_ServiceHealth_ActionGroups')]", - "parameters": { - "ALZMonitorResourceGroupName": { - "value": "[[[parameters('ALZMonitorResourceGroupName')]" - }, - "ALZMonitorResourceGroupTags": { - "value": "[[[parameters('ALZMonitorResourceGroupTags')]" - }, - "ALZMonitorResourceGroupLocation": { - "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" - }, - "ALZMonitorActionGroupEmail": { - "value": "[[[parameters('ALZMonitorActionGroupEmail')]" - }, - "ALZLogicappResourceId": { - "value": "[[[parameters('ALZLogicappResourceId')]" - }, - "ALZLogicappCallbackUrl": { - "value": "[[[parameters('ALZLogicappCallbackUrl')]" - }, - "ALZArmRoleId": { - "value": "[[[parameters('ALZArmRoleId')]" - }, - "ALZEventHubResourceId": { - "value": "[[[parameters('ALZEventHubResourceId')]" - }, - "ALZWebhookServiceUri": { - "value": "[[[parameters('ALZWebhookServiceUri')]" - }, - "ALZFunctionResourceId": { - "value": "[[[parameters('ALZFunctionResourceId')]" - }, - "ALZFunctionTriggerUrl": { - "value": "[[[parameters('ALZFunctionTriggerUrl')]" - }, - "BYOActionGroup": { - "value": "[[[parameters('BYOActionGroup')]" - }, - "BYOAlertProcessingRule": { - "value": "[[[parameters('BYOAlertProcessingRule')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_ResHlthUnhealthy", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_ResourceHealth_Unhealthy_Alert", - "parameters": { - "enabled": { - "value": "[[[parameters('ResHlthUnhealthyAlertState')]" - }, - "effect": { - "value": "[[[parameters('ResHlthUnhealthyPolicyEffect')]" - }, - "alertResourceGroupName": { - "value": "[[[parameters('ALZMonitorResourceGroupName')]" - }, - "alertResourceGroupTags": { - "value": "[[[parameters('ALZMonitorResourceGroupTags')]" - }, - "alertResourceGroupLocation": { - "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" - }, - "BYOActionGroup": { - "value": "[[[parameters('BYOActionGroup')]" - }, - "MonitorDisable": { - "value": "[[[parameters('MonitorDisable')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_SvcHlthAdvisory", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_ServiceHealth_HealthAdvisory", - "parameters": { - "enabled": { - "value": "[[[parameters('SvcHlthAdvisoryAlertState')]" - }, - "effect": { - "value": "[[[parameters('serviceHealthAdvisoryPolicyEffect')]" - }, - "alertResourceGroupName": { - "value": "[[[parameters('ALZMonitorResourceGroupName')]" - }, - "alertResourceGroupTags": { - "value": "[[[parameters('ALZMonitorResourceGroupTags')]" - }, - "alertResourceGroupLocation": { - "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" - }, - "ALZMonitorActionGroupEmail": { - "value": "[[[parameters('ALZMonitorActionGroupEmail')]" - }, - "BYOActionGroup": { - "value": "[[[parameters('BYOActionGroup')]" - }, - "MonitorDisable": { - "value": "[[[parameters('MonitorDisable')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_SvcHlthIncident", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_ServiceHealth_Incident", - "parameters": { - "enabled": { - "value": "[[[parameters('SvcHlthIncidentAlertState')]" - }, - "effect": { - "value": "[[[parameters('serviceHealthIncidentPolicyEffect')]" - }, - "alertResourceGroupName": { - "value": "[[[parameters('ALZMonitorResourceGroupName')]" - }, - "alertResourceGroupTags": { - "value": "[[[parameters('ALZMonitorResourceGroupTags')]" - }, - "alertResourceGroupLocation": { - "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" - }, - "ALZMonitorActionGroupEmail": { - "value": "[[[parameters('ALZMonitorActionGroupEmail')]" - }, - "BYOActionGroup": { - "value": "[[[parameters('BYOActionGroup')]" - }, - "MonitorDisable": { - "value": "[[[parameters('MonitorDisable')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_SvcHlthMaintenance", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_ServiceHealth_Maintenance", - "parameters": { - "enabled": { - "value": "[[[parameters('SvcHlthMaintenanceAlertState')]" - }, - "effect": { - "value": "[[[parameters('serviceHealthMaintenancePolicyEffect')]" - }, - "alertResourceGroupName": { - "value": "[[[parameters('ALZMonitorResourceGroupName')]" - }, - "alertResourceGroupTags": { - "value": "[[[parameters('ALZMonitorResourceGroupTags')]" - }, - "alertResourceGroupLocation": { - "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" - }, - "BYOActionGroup": { - "value": "[[[parameters('BYOActionGroup')]" - }, - "ALZMonitorActionGroupEmail": { - "value": "[[[parameters('ALZMonitorActionGroupEmail')]" - }, - "MonitorDisable": { - "value": "[[[parameters('MonitorDisable')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_svcHlthSecAdvisory", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_ServiceHealth_SecurityAdvisory", - "parameters": { - "enabled": { - "value": "[[[parameters('svcHlthSecAdvisoryAlertState')]" - }, - "effect": { - "value": "[[[parameters('serviceHealthSecurityPolicyEffect')]" - }, - "alertResourceGroupName": { - "value": "[[[parameters('ALZMonitorResourceGroupName')]" - }, - "alertResourceGroupTags": { - "value": "[[[parameters('ALZMonitorResourceGroupTags')]" - }, - "alertResourceGroupLocation": { - "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" - }, - "ALZMonitorActionGroupEmail": { - "value": "[[[parameters('ALZMonitorActionGroupEmail')]" - }, - "BYOActionGroup": { - "value": "[[[parameters('BYOActionGroup')]" - }, - "MonitorDisable": { - "value": "[[[parameters('MonitorDisable')]" - } - } - } - ], - "policyType": "Custom", - "policyDefinitionGroups": null - } - }, - "$fxv#12": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_ERGw_ExpressRouteCpuUtil_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy ERG ExpressRoute CPU Utilization Alert\",\r\n \"description\": \"Policy to audit/deploy ER Gateway Express Route CPU Utilization Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.0\",\r\n \"category\": \"Network\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"1\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT1M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"80\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/expressroutegateways\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/expressroutegateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"ExpressRouteGatewayCpuUtilization\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/expressroutegateways/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-GatewayERCPUAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for ER Gateway Express Route CPU Utilization\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"ExpressRouteGatewayCpuUtilization\",\r\n \"metricNamespace\": \"Microsoft.Network/expressroutegateways\",\r\n \"metricName\": \"ExpressRouteGatewayCpuUtilization\",\r\n \"operator\": \"GreaterThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#120": { - "type": "Microsoft.Authorization/policySetDefinitions", - "apiVersion": "2021-06-01", - "name": "Notification-Assets", - "properties": { - "displayName": "Deploy Azure Monitor Baseline Alerts - Notification Assets", - "description": "Initiative to deploy AMBA Notification Assets", - "metadata": { - "version": "1.2.0", - "category": "Monitoring", - "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", - "alzCloudEnvironments": [ - "AzureCloud" - ], - "_deployed_by_amba": true - }, - "parameters": { - "ALZMonitorResourceGroupName": { - "type": "String", - "defaultValue": "ALZ-Monitoring-RG", - "metadata": { - "displayName": "Resource Group Name", - "description": "Name of the resource group to deploy the alerts to" - } - }, - "ALZMonitorResourceGroupTags": { - "type": "Object", - "defaultValue": { - "_deployed_by_alz_monitor": true - }, - "metadata": { - "displayName": "Resource Group Tags", - "description": "Tags to apply to the resource group" - } - }, - "ALZMonitorResourceGroupLocation": { - "type": "String", - "defaultValue": "centralus", - "metadata": { - "displayName": "Resource Group Location", - "description": "Location of the resource group" - } - }, - "ALZMonitorActionGroupEmail": { - "type": "String", - "metadata": { - "displayName": "Action Group Email Addresses", - "description": "Email addresses to send alerts to" - }, - "defaultValue": "" - }, - "ALZLogicappResourceId": { - "type": "String", - "metadata": { - "displayName": "Logic App Resource Id", - "description": "Logic App Resource Id for Action Group to send alerts to" - }, - "defaultValue": "" - }, - "ALZLogicappCallbackUrl": { - "type": "String", - "metadata": { - "displayName": "Logic App Callback URL", - "description": "Callback URL that triggers the Logic App" - }, - "defaultValue": "" - }, - "ALZArmRoleId": { - "type": "String", - "metadata": { - "displayName": "Arm Role Id", - "description": "Arm Built-in Role Id for action group to send alerts to a subscription level, will only send to individual members of role" - }, - "defaultValue": "" - }, - "ALZEventHubResourceId": { - "type": "String", - "metadata": { - "displayName": "Event Hub resource id", - "description": "Event Hub resource id for action group to send alerts to" - }, - "defaultValue": "" - }, - "ALZWebhookServiceUri": { - "type": "String", - "metadata": { - "displayName": "Webhook Service Uri", - "description": "Indicates the service uri of the webhook to send alerts to" - }, - "defaultValue": "" - }, - "ALZFunctionResourceId": { - "type": "String", - "metadata": { - "displayName": "Function Resource Id", - "description": "Function Resource Id for Action Group to send alerts to" - }, - "defaultValue": "" - }, - "ALZFunctionTriggerUrl": { - "type": "String", - "metadata": { - "displayName": "Function Trigger URL", - "description": "URL that triggers the Function" - }, - "defaultValue": "" - }, - "BYOActionGroup": { - "type": "String", - "metadata": { - "displayName": "Customer defined Action Group Resource ID", - "description": "The Resource ID of an existing Action Group already deployed by the customer in his environment" - }, - "defaultValue": "" - }, - "BYOAlertProcessingRule": { - "type": "String", - "metadata": { - "displayName": "Customer defined Alert Processing Rule Resource ID", - "description": "The Resource ID of an existing Alert Processing Rule already deployed by the customer in his environment" - }, - "defaultValue": "" - } - }, - "policyDefinitions": [ - { - "policyDefinitionReferenceId": "ALZ_AlertProcessing_Rule", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_AlertProcessing_Rule", - "parameters": { - "ALZMonitorResourceGroupName": { - "value": "[[[parameters('ALZMonitorResourceGroupName')]" - }, - "ALZMonitorResourceGroupTags": { - "value": "[[[parameters('ALZMonitorResourceGroupTags')]" - }, - "ALZMonitorResourceGroupLocation": { - "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" - }, - "ALZMonitorActionGroupEmail": { - "value": "[[[parameters('ALZMonitorActionGroupEmail')]" - }, - "ALZLogicappResourceId": { - "value": "[[[parameters('ALZLogicappResourceId')]" - }, - "ALZLogicappCallbackUrl": { - "value": "[[[parameters('ALZLogicappCallbackUrl')]" - }, - "ALZArmRoleId": { - "value": "[[[parameters('ALZArmRoleId')]" - }, - "ALZEventHubResourceId": { - "value": "[[[parameters('ALZEventHubResourceId')]" - }, - "ALZWebhookServiceUri": { - "value": "[[[parameters('ALZWebhookServiceUri')]" - }, - "ALZFunctionResourceId": { - "value": "[[[parameters('ALZFunctionResourceId')]" - }, - "ALZFunctionTriggerUrl": { - "value": "[[[parameters('ALZFunctionTriggerUrl')]" - }, - "BYOActionGroup": { - "value": "[[[parameters('BYOActionGroup')]" - }, - "BYOAlertProcessingRule": { - "value": "[[[parameters('BYOAlertProcessingRule')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_Suppression_AlertProcessing_Rule", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_Suppression_AlertProcessing_Rule", - "parameters": { - "ALZMonitorResourceGroupName": { - "value": "[[[parameters('ALZMonitorResourceGroupName')]" - }, - "ALZMonitorResourceGroupTags": { - "value": "[[[parameters('ALZMonitorResourceGroupTags')]" - }, - "ALZMonitorResourceGroupLocation": { - "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" - } - } - } - ], - "policyType": "Custom", - "policyDefinitionGroups": null - } - }, - "$fxv#121": { - "type": "Microsoft.Authorization/policySetDefinitions", - "apiVersion": "2021-06-01", - "name": "Alerting-HybridVM", - "properties": { - "displayName": "Deploy Azure Monitor Baseline Alerts for Hybrid VMs", - "description": "Initiative to deploy AMBA Hybrid VM alerts", - "metadata": { - "version": "1.0.1", - "category": "Monitoring", - "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", - "alzCloudEnvironments": [ - "AzureCloud" - ], - "_deployed_by_amba": true - }, - "parameters": { - "ALZMonitorResourceGroupName": { - "type": "String", - "defaultValue": "ALZ-Monitoring-RG", - "metadata": { - "displayName": "ALZ Monitor Resource Group Name", - "description": "Name of the resource group where the ALZ Monitor resources will be deployed" - } - }, - "ALZMonitorResourceGroupTags": { - "type": "Object", - "defaultValue": { - "_deployed_by_alz_monitor": true - }, - "metadata": { - "displayName": "ALZ Monitor Resource Group Tags", - "description": "Tags for the resource group where the ALZ Monitor resources will be deployed" - } - }, - "ALZMonitorResourceGroupLocation": { - "type": "String", - "defaultValue": "centralus", - "metadata": { - "displayName": "ALZ Monitor Resource Group Location", - "description": "Location of the resource group where the ALZ Monitor resources will be deployed" - } - }, - "ALZUserAssignedManagedIdentityName": { - "type": "string", - "defaultValue": "id-AMBA-ARG-Reader-001", - "metadata": { - "description": "The name of the user assigned managed identity to be created for monitoring purpose.", - "displayName": "Name of the user assigned managed identity to be created." - } - }, - "ALZManagementSubscriptionId": { - "type": "string", - "defaultValue": "", - "metadata": { - "description": "The subscription ID of the management subscription where the user assigned managed identity will be created." - } - }, - "BYOUserAssignedManagedIdentityResourceId": { - "type": "string", - "defaultValue": "", - "metadata": { - "description": "The resource Id of the user assigned managed identity provided by the customer.", - "displayName": "Customer defined User Assigned managed Identity resource Id." - } - }, - "HybridVMHeartBeatRGAlertSeverity": { - "type": "String", - "defaultValue": "1", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "Hybrid VM Heart Beat RG Alert Severity", - "description": "Severity of the alert for VM Heart Beat RG" - } - }, - "HybridVMHeartBeatRGWindowSize": { - "type": "string", - "defaultValue": "PT15M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "Hybrid VM Heart Beat RG Window Size", - "description": "Window size for the alert" - } - }, - "HybridVMHeartBeatRGEvaluationFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "Hybrid VM Heart Beat RG Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "HybridVMHeartBeatRGAutoMitigate": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Hybrid VM Heart Beat RG Auto Mitigate", - "description": "Auto Mitigate for the alert" - } - }, - "HybridVMHeartBeatRGAutoResolve": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Hybrid VM Heart Beat RG Auto Resolve", - "description": "Auto Resolve for the alert" - } - }, - "HybridVMHeartBeatRGAutoResolveTime": { - "type": "string", - "defaultValue": "00:10:00", - "metadata": { - "displayName": "Hybrid VM Heart Beat RG Auto Resolve Time", - "description": "Auto Resolve Time for the alert" - } - }, - "HybridVMHeartBeatRGPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "Hybrid VM Heart Beat RG Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" - } - }, - "HybridVMHeartBeatRGAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Hybrid VM Heart Beat RG Alert State", - "description": "Alert state for the alert" - } - }, - "HybridVMHeartBeatRGThreshold": { - "type": "string", - "defaultValue": "10", - "metadata": { - "displayName": "Hybrid VM Heart Beat RG Threshold", - "description": "Threshold for the alert" - } - }, - "HybridVMHeartBeatRGOperator": { - "type": "string", - "defaultValue": "GreaterThan", - "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" - ], - "metadata": { - "displayName": "Hybrid VM Heart Beat RG Operator", - "description": "Operator for the alert" - } - }, - "HybridVMHeartBeatRGTimeAggregation": { - "type": "string", - "defaultValue": "Average", - "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" - ], - "metadata": { - "displayName": "Hybrid VM Heart Beat RG Time Aggregation", - "description": "Time Aggregation for the alert" - } - }, - "HybridVMNetworkInAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "Hybrid VM Network In Alert Severity", - "description": "Severity of the alert for VM Network In" - } - }, - "HybridVMNetworkInWindowSize": { - "type": "string", - "defaultValue": "PT15M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "Hybrid VM Network In Window Size", - "description": "Window size for the alert" - } - }, - "HybridVMNetworkInEvaluationFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "Hybrid VM Network In Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "HybridVMNetworkInAutoMitigate": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Hybrid VM Network In Auto Mitigate", - "description": "Auto Mitigate for the alert" - } - }, - "HybridVMNetworkInAutoResolve": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Hybrid VM Network In Auto Resolve", - "description": "Auto Resolve for the alert" - } - }, - "HybridVMNetworkInAutoResolveTime": { - "type": "string", - "defaultValue": "00:10:00", - "metadata": { - "displayName": "Hybrid VM Network In Auto Resolve Time", - "description": "Auto Resolve Time for the alert" - } - }, - "HybridVMNetworkInPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "Hybrid VM Network In Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" - } - }, - "HybridVMNetworkInAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Hybrid VM Network In Alert State", - "description": "Alert state for the alert" - } - }, - "HybridVMNetworkInThreshold": { - "type": "string", - "defaultValue": "10000000", - "metadata": { - "displayName": "Hybrid VM Network In Threshold", - "description": "Threshold for the alert" - } - }, - "HybridVMNetworkInOperator": { - "type": "string", - "defaultValue": "GreaterThan", - "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" - ], - "metadata": { - "displayName": "Hybrid VM Network In Operator", - "description": "Operator for the alert" - } - }, - "HybridVMNetworkInTimeAggregation": { - "type": "string", - "defaultValue": "Average", - "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" - ], - "metadata": { - "displayName": "Hybrid VM Network In Time Aggregation", - "description": "Time Aggregation for the alert" - } - }, - "HybridVMNetworkInEvaluationPeriods": { - "type": "string", - "defaultValue": "1", - "metadata": { - "displayName": "Hybrid VM Network In Evaluation Periods", - "description": "Evaluation Periods for the alert" - } - }, - "HybridVMNetworkInFailingPeriods": { - "type": "string", - "defaultValue": "1", - "metadata": { - "displayName": "Hybrid VM Network In Failing Periods", - "description": "Failing Periods for the alert" - } - }, - "HybridVMNetworkInComputersToInclude": { - "type": "array", - "defaultValue": [ - "*" - ], - "metadata": { - "displayName": "Hybrid VM Network In Computers To Include", - "description": "Computers To Include for the alert" - } - }, - "HybridVMNetworkInNetworkInterfaceToInclude": { - "type": "array", - "defaultValue": [ - "*" - ], - "metadata": { - "displayName": "Hybrid VM Network In Network Interface To Include", - "description": "Network Interface To Include for the alert" - } - }, - "HybridVMNetworkOutAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "Hybrid VM Network Out Alert Severity", - "description": "Severity of the alert for VM Network Out" - } - }, - "HybridVMNetworkOutWindowSize": { - "type": "string", - "defaultValue": "PT15M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "Hybrid VM Network Out Window Size", - "description": "Window size for the alert" - } - }, - "HybridVMNetworkOutEvaluationFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "Hybrid VM Network Out Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "HybridVMNetworkOutAutoMitigate": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Hybrid VM Network Out Auto Mitigate", - "description": "Auto Mitigate for the alert" - } - }, - "HybridVMNetworkOutAutoResolve": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Hybrid VM Network Out Auto Resolve", - "description": "Auto Resolve for the alert" - } - }, - "HybridVMNetworkOutAutoResolveTime": { - "type": "string", - "defaultValue": "00:10:00", - "metadata": { - "displayName": "Hybrid VM Network Out Auto Resolve Time", - "description": "Auto Resolve Time for the alert" - } - }, - "HybridVMNetworkOutPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "Hybrid VM Network Out Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" - } - }, - "HybridVMNetworkOutAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Hybrid VM Network Out Alert State", - "description": "Alert state for the alert, true will enable the alert, false will disable the alert" - } - }, - "HybridVMNetworkOutThreshold": { - "type": "string", - "defaultValue": "10000000", - "metadata": { - "displayName": "Hybrid VM Network Out Threshold", - "description": "Threshold for the alert" - } - }, - "HybridVMNetworkOutOperator": { - "type": "string", - "defaultValue": "GreaterThan", - "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" - ], - "metadata": { - "displayName": "Hybrid VM Network Out Operator", - "description": "Operator for the alert" - } - }, - "HybridVMNetworkOutTimeAggregation": { - "type": "string", - "defaultValue": "Average", - "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" - ], - "metadata": { - "displayName": "Hybrid VM Network Out Time Aggregation", - "description": "Time Aggregation for the alert" - } - }, - "HybridVMNetworkOutEvaluationPeriods": { - "type": "string", - "defaultValue": "1", - "metadata": { - "displayName": "Hybrid VM Network Out Evaluation Periods", - "description": "Evaluation Periods for the alert" - } - }, - "HybridVMNetworkOutFailingPeriods": { - "type": "string", - "defaultValue": "1", - "metadata": { - "displayName": "Hybrid VM Network Out Failing Periods", - "description": "Failing Periods for the alert" - } - }, - "HybridVMNetworkOutComputersToInclude": { - "type": "array", - "defaultValue": [ - "*" - ], - "metadata": { - "displayName": "Hybrid VM Network Out Computers To Include", - "description": "Computers To Include for the alert" - } - }, - "HybridVMNetworkOutNetworkInterfaceToInclude": { - "type": "array", - "defaultValue": [ - "*" - ], - "metadata": { - "displayName": "Hybrid VM Network Out Network Interface To Include", - "description": "Network Interface To Include for the alert" - } - }, - "HybridVMOSDiskReadLatencyAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "Hybrid VM OS Disk Read Latency Alert Severity", - "description": "Severity of the alert for VM OS Disk Read Latency" - } - }, - "HybridVMOSDiskReadLatencyWindowSize": { - "type": "string", - "defaultValue": "PT15M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "Hybrid VM OS Disk Read Latency Window Size", - "description": "Window size for the alert" - } - }, - "HybridVMOSDiskReadLatencyEvaluationFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "Hybrid VM OS Disk Read Latency Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "HybridVMOSDiskReadLatencyAutoMitigate": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Hybrid VM OS Disk Read Latency Auto Mitigate", - "description": "Auto Mitigate for the alert" - } - }, - "HybridVMOSDiskReadLatencyAutoResolve": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Hybrid VM OS Disk Read Latency Auto Resolve", - "description": "Auto Resolve for the alert" - } - }, - "HybridVMOSDiskReadLatencyAutoResolveTime": { - "type": "string", - "defaultValue": "00:10:00", - "metadata": { - "displayName": "Hybrid VM OS Disk Read Latency Auto Resolve Time", - "description": "Auto Resolve Time for the alert" - } - }, - "HybridVMOSDiskReadLatencyPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "Hybrid VM OS Disk Read Latency Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" - } - }, - "HybridVMOSDiskReadLatencyAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Hybrid VM OS Disk Read Latency Alert State", - "description": "Alert state for the alert, true will enable the alert, false will disable the alert" - } - }, - "HybridVMOSDiskReadLatencyThreshold": { - "type": "string", - "defaultValue": "30", - "metadata": { - "displayName": "Hybrid VM OS Disk Read Latency Threshold", - "description": "Threshold for the alert" - } - }, - "HybridVMOSDiskReadLatencyOperator": { - "type": "string", - "defaultValue": "GreaterThan", - "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" - ], - "metadata": { - "displayName": "Hybrid VM OS Disk Read Latency Operator", - "description": "Operator for the alert" - } - }, - "HybridVMOSDiskReadLatencyTimeAggregation": { - "type": "string", - "defaultValue": "Average", - "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" - ], - "metadata": { - "displayName": "Hybrid VM OS Disk Read Latency Time Aggregation", - "description": "Time Aggregation for the alert" - } - }, - "HybridVMOSDiskReadLatencyEvaluationPeriods": { - "type": "string", - "defaultValue": "1", - "metadata": { - "displayName": "Hybrid VM OS Disk Read Latency Evaluation Periods", - "description": "Evaluation Periods for the alert" - } - }, - "HybridVMOSDiskReadLatencyFailingPeriods": { - "type": "string", - "defaultValue": "1", - "metadata": { - "displayName": "Hybrid VM OS Disk Read Latency Failing Periods", - "description": "Failing Periods for the alert" - } - }, - "HybridVMOSDiskReadLatencyComputersToInclude": { - "type": "array", - "defaultValue": [ - "*" - ], - "metadata": { - "displayName": "Hybrid VM OS Disk Read Latency Computers To Include", - "description": "Computers To Include for the alert" - } - }, - "HybridVMOSDiskReadLatencyDisksToInclude": { - "type": "array", - "defaultValue": [ - "C:", - "/" - ], - "metadata": { - "displayName": "Hybrid VM OS Disk Read Latency Disks To Include", - "description": "Disks To Include for the alert" - } - }, - "HybridVMOSDiskWriteLatencyAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "Hybrid VM OS Disk Write Latency Alert Severity", - "description": "Severity of the alert for VM OS Disk Write Latency" - } - }, - "HybridVMOSDiskWriteLatencyWindowSize": { - "type": "string", - "defaultValue": "PT15M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "Hybrid VM OS Disk Write Latency Window Size", - "description": "Window size for the alert" - } - }, - "HybridVMOSDiskWriteLatencyEvaluationFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "Hybrid VM OS Disk Write Latency Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "HybridVMOSDiskWriteLatencyAutoMitigate": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Hybrid VM OS Disk Write Latency Auto Mitigate", - "description": "Auto Mitigate for the alert" - } - }, - "HybridVMOSDiskWriteLatencyAutoResolve": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Hybrid VM OS Disk Write Latency Auto Resolve", - "description": "Auto Resolve for the alert" - } - }, - "HybridVMOSDiskWriteLatencyAutoResolveTime": { - "type": "string", - "defaultValue": "00:10:00", - "metadata": { - "displayName": "Hybrid VM OS Disk Write Latency Auto Resolve Time", - "description": "Auto Resolve Time for the alert" - } - }, - "HybridVMOSDiskWriteLatencyPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "Hybrid VM OS Disk Write Latency Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" - } - }, - "HybridVMOSDiskWriteLatencyAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Hybrid VM OS Disk Write Latency Alert State", - "description": "Alert state for the alert, true will enable the alert, false will disable the alert" - } - }, - "HybridVMOSDiskWriteLatencyThreshold": { - "type": "string", - "defaultValue": "50", - "metadata": { - "displayName": "Hybrid VM OS Disk Write Latency Threshold", - "description": "Threshold for the alert" - } - }, - "HybridVMOSDiskWriteLatencyOperator": { - "type": "string", - "defaultValue": "GreaterThan", - "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" - ], - "metadata": { - "displayName": "Hybrid VM OS Disk Write Latency Operator", - "description": "Operator for the alert" - } - }, - "HybridVMOSDiskWriteLatencyTimeAggregation": { - "type": "string", - "defaultValue": "Average", - "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" - ], - "metadata": { - "displayName": "Hybrid VM OS Disk Write Latency Time Aggregation", - "description": "Time Aggregation for the alert" - } - }, - "HybridVMOSDiskWriteLatencyEvaluationPeriods": { - "type": "string", - "defaultValue": "1", - "metadata": { - "displayName": "Hybrid VM OS Disk Write Latency Evaluation Periods", - "description": "Evaluation Periods for the alert" - } - }, - "HybridVMOSDiskWriteLatencyFailingPeriods": { - "type": "string", - "defaultValue": "1", - "metadata": { - "displayName": "Hybrid VM OS Disk Write Latency Failing Periods", - "description": "Failing Periods for the alert" - } - }, - "HybridVMOSDiskWriteLatencyComputersToInclude": { - "type": "array", - "defaultValue": [ - "*" - ], - "metadata": { - "displayName": "Hybrid VM OS Disk Write Latency Computers To Include", - "description": "Computers To Include for the alert" - } - }, - "HybridVMOSDiskWriteLatencyDisksToInclude": { - "type": "array", - "defaultValue": [ - "C:", - "/" - ], - "metadata": { - "displayName": "Hybrid VM OS Disk Write Latency Disks To Include", - "description": "Disks To Include for the alert" - } - }, - "HybridVMOSDiskSpaceAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "Hybrid VM OS Disk Space Alert Severity", - "description": "Severity of the alert for VM OS Disk Space" - } - }, - "HybridVMOSDiskSpaceWindowSize": { - "type": "string", - "defaultValue": "PT15M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "Hybrid VM OS Disk Space Window Size", - "description": "Window size for the alert" - } - }, - "HybridVMOSDiskSpaceEvaluationFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "Hybrid VM OS Disk Space Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "HybridVMOSDiskSpaceAutoMitigate": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Hybrid VM OS Disk Space Auto Mitigate", - "description": "Auto Mitigate for the alert" - } - }, - "HybridVMOSDiskSpaceAutoResolve": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Hybrid VM OS Disk Space Auto Resolve", - "description": "Auto Resolve for the alert" - } - }, - "HybridVMOSDiskSpaceAutoResolveTime": { - "type": "string", - "defaultValue": "00:10:00", - "metadata": { - "displayName": "Hybrid VM OS Disk Space Auto Resolve Time", - "description": "Auto Resolve Time for the alert" - } - }, - "HybridVMOSDiskSpacePolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "Hybrid VM OS Disk Space Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" - } - }, - "HybridVMOSDiskSpaceAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Hybrid VM OS Disk Space Alert State", - "description": "Alert state for the alert, true will enable the alert, false will disable the alert" - } - }, - "HybridVMOSDiskSpaceThreshold": { - "type": "string", - "defaultValue": "10", - "metadata": { - "displayName": "Hybrid VM OS Disk Space Threshold", - "description": "Threshold for the alert" - } - }, - "HybridVMOSDiskSpaceOperator": { - "type": "string", - "defaultValue": "LessThan", - "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" - ], - "metadata": { - "displayName": "Hybrid VM OS Disk Space Operator", - "description": "Operator for the alert" - } - }, - "HybridVMOSDiskSpaceTimeAggregation": { - "type": "string", - "defaultValue": "Average", - "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" - ], - "metadata": { - "displayName": "Hybrid VM OS Disk Space Time Aggregation", - "description": "Time Aggregation for the alert" - } - }, - "HybridVMOSDiskSpaceEvaluationPeriods": { - "type": "string", - "defaultValue": "1", - "metadata": { - "displayName": "Hybrid VM OS Disk Space Evaluation Periods", - "description": "Evaluation Periods for the alert" - } - }, - "HybridVMOSDiskSpaceFailingPeriods": { - "type": "string", - "defaultValue": "1", - "metadata": { - "displayName": "Hybrid VM OS Disk Space Failing Periods", - "description": "Failing Periods for the alert" - } - }, - "HybridVMOSDiskSpaceComputersToInclude": { - "type": "array", - "defaultValue": [ - "*" - ], - "metadata": { - "displayName": "Hybrid VM OS Disk Space Computers To Include", - "description": "Computers To Include for the alert" - } - }, - "HybridVMOSDiskSpaceDisksToInclude": { - "type": "array", - "defaultValue": [ - "C:", - "/" - ], - "metadata": { - "displayName": "Hybrid VM OS Disk Space Disks To Include", - "description": "Disks To Include for the alert" - } - }, - "HybridVMPercentCPUAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "Hybrid VM Percent CPU Alert Severity", - "description": "Severity of the alert for VM Percent CPU" - } - }, - "HybridVMPercentCPUWindowSize": { - "type": "string", - "defaultValue": "PT15M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "Hybrid VM Percent CPU Window Size", - "description": "Window size for the alert" - } - }, - "HybridVMPercentCPUEvaluationFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "Hybrid VM Percent CPU Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "HybridVMPercentCPUAutoMitigate": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Hybrid VM Percent CPU Auto Mitigate", - "description": "Auto Mitigate for the alert" - } - }, - "HybridVMPercentCPUAutoResolve": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Hybrid VM Percent CPU Auto Resolve", - "description": "Auto Resolve for the alert" - } - }, - "HybridVMPercentCPUAutoResolveTime": { - "type": "string", - "defaultValue": "00:10:00", - "metadata": { - "displayName": "Hybrid VM Percent CPU Auto Resolve Time", - "description": "Auto Resolve Time for the alert" - } - }, - "HybridVMPercentCPUPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "Hybrid VM Percent CPU Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" - } - }, - "HybridVMPercentCPUAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Hybrid VM Percent CPU Alert State", - "description": "Alert state for the alert, true will enable the alert, false will disable the alert" - } - }, - "HybridVMPercentCPUThreshold": { - "type": "string", - "defaultValue": "85", - "metadata": { - "displayName": "Hybrid VM Percent CPU Threshold", - "description": "Threshold for the alert" - } - }, - "HybridVMPercentCPUOperator": { - "type": "string", - "defaultValue": "GreaterThan", - "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" - ], - "metadata": { - "displayName": "Hybrid VM Percent CPU Operator", - "description": "Operator for the alert" - } - }, - "HybridVMPercentCPUTimeAggregation": { - "type": "string", - "defaultValue": "Average", - "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" - ], - "metadata": { - "displayName": "Hybrid VM Percent CPU Time Aggregation", - "description": "Time Aggregation for the alert" - } - }, - "HybridVMPercentMemoryAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "Hybrid VM Percent Memory Alert Severity", - "description": "Severity of the alert for VM Percent Memory" - } - }, - "HybridVMPercentMemoryWindowSize": { - "type": "string", - "defaultValue": "PT15M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "Hybrid VM Percent Memory Window Size", - "description": "Window size for the alert" - } - }, - "HybridVMPercentMemoryEvaluationFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "Hybrid VM Percent Memory Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "HybridVMPercentMemoryAutoMitigate": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Hybrid VM Percent Memory Auto Mitigate", - "description": "Auto Mitigate for the alert" - } - }, - "HybridVMPercentMemoryAutoResolve": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Hybrid VM Percent Memory Auto Resolve", - "description": "Auto Resolve for the alert" - } - }, - "HybridVMPercentMemoryAutoResolveTime": { - "type": "string", - "defaultValue": "00:10:00", - "metadata": { - "displayName": "Hybrid VM Percent Memory Auto Resolve Time", - "description": "Auto Resolve Time for the alert" - } - }, - "HybridVMPercentMemoryPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "Hybrid VM Percent Memory Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" - } - }, - "HybridVMPercentMemoryAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Hybrid VM Percent Memory Alert State", - "description": "Alert state for the alert, true will enable the alert, false will disable the alert" - } - }, - "HybridVMPercentMemoryThreshold": { - "type": "string", - "defaultValue": "10", - "metadata": { - "displayName": "Hybrid VM Percent Memory Threshold", - "description": "Threshold for the alert" - } - }, - "HybridVMPercentMemoryOperator": { - "type": "string", - "defaultValue": "LessThan", - "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" - ], - "metadata": { - "displayName": "Hybrid VM Percent Memory Operator", - "description": "Operator for the alert" - } - }, - "HybridVMPercentMemoryTimeAggregation": { - "type": "string", - "defaultValue": "Average", - "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" - ], - "metadata": { - "displayName": "Hybrid VM Percent Memory Time Aggregation", - "description": "Time Aggregation for the alert" - } - }, - "HybridVMDataDiskSpaceAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "Hybrid VM Data Disk Space Alert Severity", - "description": "Severity of the alert for VM Data Disk Space" - } - }, - "HybridVMDataDiskSpaceWindowSize": { - "type": "string", - "defaultValue": "PT15M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "Hybrid VM Data Disk Space Window Size", - "description": "Window size for the alert" - } - }, - "HybridVMDataDiskSpaceEvaluationFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "Hybrid VM Data Disk Space Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "HybridVMDataDiskSpaceAutoMitigate": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Hybrid VM Data Disk Space Auto Mitigate", - "description": "Auto Mitigate for the alert" - } - }, - "HybridVMDataDiskSpaceAutoResolve": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Hybrid VM Data Disk Space Auto Resolve", - "description": "Auto Resolve for the alert" - } - }, - "HybridVMDataDiskSpaceAutoResolveTime": { - "type": "string", - "defaultValue": "00:10:00", - "metadata": { - "displayName": "Hybrid VM Data Disk Space Auto Resolve Time", - "description": "Auto Resolve Time for the alert" - } - }, - "HybridVMDataDiskSpacePolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "Hybrid VM Data Disk Space Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" - } - }, - "HybridVMDataDiskSpaceAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Hybrid VM Data Disk Space Alert State", - "description": "Alert state for the alert, true will enable the alert, false will disable the alert" - } - }, - "HybridVMDataDiskSpaceThreshold": { - "type": "string", - "defaultValue": "10", - "metadata": { - "displayName": "Hybrid VM Data Disk Space Threshold", - "description": "Threshold for the alert" - } - }, - "HybridVMDataDiskSpaceOperator": { - "type": "string", - "defaultValue": "LessThan", - "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" - ], - "metadata": { - "displayName": "Hybrid VM Data Disk Space Operator", - "description": "Operator for the alert" - } - }, - "HybridVMDataDiskSpaceTimeAggregation": { - "type": "string", - "defaultValue": "Average", - "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" - ], - "metadata": { - "displayName": "Hybrid VM Data Disk Space Time Aggregation", - "description": "Time Aggregation for the alert" - } - }, - "HybridVMDataDiskSpaceEvaluationPeriods": { - "type": "string", - "defaultValue": "1", - "metadata": { - "displayName": "Hybrid VM Data Disk Space Evaluation Periods", - "description": "Evaluation Periods for the alert" - } - }, - "HybridVMDataDiskSpaceFailingPeriods": { - "type": "string", - "defaultValue": "1", - "metadata": { - "displayName": "Hybrid VM Data Disk Space Failing Periods", - "description": "Failing Periods for the alert" - } - }, - "HybridVMDataDiskSpaceDisksToInclude": { - "type": "array", - "defaultValue": [ - "*" - ], - "metadata": { - "displayName": "Hybrid VM Data Disk Space Disks To Include", - "description": "Disks To Include for the alert" - } - }, - "HybridVMDataDiskReadLatencyAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "Hybrid VM Data Disk Read Latency Alert Severity", - "description": "Severity of the alert for VM Data Disk Read Latency" - } - }, - "HybridVMDataDiskReadLatencyWindowSize": { - "type": "string", - "defaultValue": "PT15M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "Hybrid VM Data Disk Read Latency Window Size", - "description": "Window size for the alert" - } - }, - "HybridVMDataDiskReadLatencyEvaluationFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "Hybrid VM Data Disk Read Latency Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "HybridVMDataDiskReadLatencyAutoMitigate": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Hybrid VM Data Disk Read Latency Auto Mitigate", - "description": "Auto Mitigate for the alert" - } - }, - "HybridVMDataDiskReadLatencyAutoResolve": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Hybrid VM Data Disk Read Latency Auto Resolve", - "description": "Auto Resolve for the alert" - } - }, - "HybridVMDataDiskReadLatencyAutoResolveTime": { - "type": "string", - "defaultValue": "00:10:00", - "metadata": { - "displayName": "Hybrid VM Data Disk Read Latency Auto Resolve Time", - "description": "Auto Resolve Time for the alert" - } - }, - "HybridVMDataDiskReadLatencyPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "Hybrid VM Data Disk Read Latency Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" - } - }, - "HybridVMDataDiskReadLatencyAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Hybrid VM Data Disk Read Latency Alert State", - "description": "Alert state for the alert, true will enable the alert, false will disable the alert" - } - }, - "HybridVMDataDiskReadLatencyThreshold": { - "type": "string", - "defaultValue": "30", - "metadata": { - "displayName": "Hybrid VM Data Disk Read Latency Threshold", - "description": "Threshold for the alert" - } - }, - "HybridVMDataDiskReadLatencyOperator": { - "type": "string", - "defaultValue": "GreaterThan", - "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" - ], - "metadata": { - "displayName": "Hybrid VM Data Disk Read Latency Operator", - "description": "Operator for the alert" - } - }, - "HybridVMDataDiskReadLatencyTimeAggregation": { - "type": "string", - "defaultValue": "Average", - "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" - ], - "metadata": { - "displayName": "Hybrid VM Data Disk Read Latency Time Aggregation", - "description": "Time Aggregation for the alert" - } - }, - "HybridVMDataDiskReadLatencyEvaluationPeriods": { - "type": "string", - "defaultValue": "1", - "metadata": { - "displayName": "Hybrid VM Data Disk Read Latency Evaluation Periods", - "description": "Evaluation Periods for the alert" - } - }, - "HybridVMDataDiskReadLatencyFailingPeriods": { - "type": "string", - "defaultValue": "1", - "metadata": { - "displayName": "Hybrid VM Data Disk Read Latency Failing Periods", - "description": "Failing Periods for the alert" - } - }, - "HybridVMDataDiskReadLatencyComputersToInclude": { - "type": "array", - "defaultValue": [ - "*" - ], - "metadata": { - "displayName": "Hybrid VM Data Disk Read Latency Computers To Include", - "description": "Computers To Include for the alert" - } - }, - "HybridVMDataDiskReadLatencyDisksToInclude": { - "type": "array", - "defaultValue": [ - "*" - ], - "metadata": { - "displayName": "Hybrid VM Data Disk Read Latency Disks To Include", - "description": "Disks To Include for the alert" - } - }, - "HybridVMDataDiskWriteLatencyAlertSeverity": { - "type": "String", - "defaultValue": "2", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "Hybrid VM Data Disk Write Latency Alert Severity", - "description": "Severity of the alert for VM Data Disk Write Latency" - } - }, - "HybridVMDataDiskWriteLatencyWindowSize": { - "type": "string", - "defaultValue": "PT15M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H", - "PT6H", - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "Hybrid VM Data Disk Write Latency Window Size", - "description": "Window size for the alert" - } - }, - "HybridVMDataDiskWriteLatencyEvaluationFrequency": { - "type": "string", - "defaultValue": "PT5M", - "allowedValues": [ - "PT1M", - "PT5M", - "PT15M", - "PT30M", - "PT1H" - ], - "metadata": { - "displayName": "Hybrid VM Data Disk Write Latency Evaluation Frequency", - "description": "Evaluation frequency for the alert" - } - }, - "HybridVMDataDiskWriteLatencyAutoMitigate": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Hybrid VM Data Disk Write Latency Auto Mitigate", - "description": "Auto Mitigate for the alert" - } - }, - "HybridVMDataDiskWriteLatencyAutoResolve": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Hybrid VM Data Disk Write Latency Auto Resolve", - "description": "Auto Resolve for the alert" - } - }, - "HybridVMDataDiskWriteLatencyAutoResolveTime": { - "type": "string", - "defaultValue": "00:10:00", - "metadata": { - "displayName": "Hybrid VM Data Disk Write Latency Auto Resolve Time", - "description": "Auto Resolve Time for the alert" - } - }, - "HybridVMDataDiskWriteLatencyPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "Hybrid VM Data Disk Write Latency Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" - } - }, - "HybridVMDataDiskWriteLatencyAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Hybrid VM Data Disk Write Latency Alert State", - "description": "Alert state for the alert, true will enable the alert, false will disable the alert" - } - }, - "HybridVMDataDiskWriteLatencyThreshold": { - "type": "string", - "defaultValue": "30", - "metadata": { - "displayName": "Hybrid VM Data Disk Write Latency Threshold", - "description": "Threshold for the alert" - } - }, - "HybridVMDataDiskWriteLatencyOperator": { - "type": "string", - "defaultValue": "GreaterThan", - "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" - ], - "metadata": { - "displayName": "Hybrid VM Data Disk Write Latency Operator", - "description": "Operator for the alert" - } - }, - "HybridVMDataDiskWriteLatencyTimeAggregation": { - "type": "string", - "defaultValue": "Average", - "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" - ], - "metadata": { - "displayName": "Hybrid VM Data Disk Write Latency Time Aggregation", - "description": "Time Aggregation for the alert" - } - }, - "HybridVMDataDiskWriteLatencyEvaluationPeriods": { - "type": "string", - "defaultValue": "1", - "metadata": { - "displayName": "Hybrid VM Data Disk Write Latency Evaluation Periods", - "description": "Evaluation Periods for the alert" - } - }, - "HybridVMDataDiskWriteLatencyFailingPeriods": { - "type": "string", - "defaultValue": "1", - "metadata": { - "displayName": "Hybrid VM Data Disk Write Latency Failing Periods", - "description": "Failing Periods for the alert" - } - }, - "HybridVMDataDiskWriteLatencyComputersToInclude": { - "type": "array", - "defaultValue": [ - "*" - ], - "metadata": { - "displayName": "Hybrid VM Data Disk Write Latency Computers To Include", - "description": "Computers To Include for the alert" - } - }, - "HybridVMDataDiskWriteLatencyDisksToInclude": { - "type": "array", - "defaultValue": [ - "*" - ], - "metadata": { - "displayName": "Hybrid VM Data Disk Write Latency Disks To Include", - "description": "Disks To Include for the alert" - } - }, - "HybridVMDisconnectedAlertSeverity": { - "type": "String", - "defaultValue": "1", - "allowedValues": [ - "0", - "1", - "2", - "3", - "4" - ], - "metadata": { - "displayName": "Hybrid VM Disconnected Alert Severity", - "description": "Severity of the Hybrid VM Disconnected alert" - } - }, - "HybridVMDisconnectedAlertWindowSize": { - "type": "string", - "defaultValue": "P1D", - "allowedValues": [ - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "Hybrid VM Disconnected Window Size", - "description": "Window size for the Hybrid VM Disconnected alert" - } - }, - "HybridVMDisconnectedAlertEvaluationFrequency": { - "type": "string", - "defaultValue": "P1D", - "allowedValues": [ - "PT12H", - "P1D" - ], - "metadata": { - "displayName": "Hybrid VM Disconnected Evaluation Frequency", - "description": "Evaluation frequency for the Hybrid VM Disconnected alert" - } - }, - "HybridVMDisconnectedAlertAutoMitigate": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Hybrid VM Disconnected Auto Mitigate", - "description": "Auto Mitigate for the Hybrid VM Disconnected alert" - } - }, - "HybridVMDisconnectedAlertPolicyEffect": { - "type": "string", - "defaultValue": "deployIfNotExists", - "allowedValues": [ - "deployIfNotExists", - "disabled" - ], - "metadata": { - "displayName": "Hybrid VM Disconnected Policy Effect", - "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" - } - }, - "HybridVMDisconnectedAlertState": { - "type": "string", - "defaultValue": "true", - "metadata": { - "displayName": "Hybrid VM Disconnected Alert State", - "description": "Alert state for the alert, true will enable the alert, false will disable the alert" - } - }, - "HybridVMDisconnectedAlertDaysThreshold": { - "type": "string", - "defaultValue": "45", - "metadata": { - "displayName": "Hybrid VM Disconnected Days Threshold", - "description": "Threshold in days for the Hybrid VM Disconnected alert" - } - }, - "HybridVMDisconnectedAlertOperator": { - "type": "string", - "defaultValue": "GreaterThanOrEqual", - "allowedValues": [ - "GreaterThan", - "GreaterThanOrEqual" - ], - "metadata": { - "displayName": "Hybrid VM Disconnected Operator", - "description": "Operator for the Hybrid VM Disconnected alert" - } - }, - "HybridVMDisconnectedAlertTimeAggregation": { - "type": "string", - "defaultValue": "Minimum", - "allowedValues": [ - "Average", - "Maximum", - "Minimum", - "Total", - "Count" - ], - "metadata": { - "displayName": "Hybrid VM Disconnected Time Aggregation", - "description": "Time Aggregation for the Hybrid VM Disconnected alert" - } - }, - "HybridVMDisconnectedAlertEvaluationPeriods": { - "type": "string", - "defaultValue": "1", - "metadata": { - "displayName": "Hybrid VM Disconnected Evaluation Periods", - "description": "Evaluation Periods for the Hybrid VM Disconnected alert" - } - }, - "HybridVMDisconnectedAlertFailingPeriods": { - "type": "string", - "defaultValue": "1", - "metadata": { - "displayName": "Hybrid VM Disconnected Failing Periods", - "description": "Failing Periods for the Hybrid VM Disconnected alert" - } - } - }, - "policyDefinitions": [ - { - "policyDefinitionReferenceId": "ALZ_HybridVMHeartBeatRG", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_Hybrid_VM_HeartBeat_Alert", - "parameters": { - "alertResourceGroupName": { - "value": "[[[parameters('ALZMonitorResourceGroupName')]" - }, - "alertResourceGroupTags": { - "value": "[[[parameters('ALZMonitorResourceGroupTags')]" - }, - "alertResourceGroupLocation": { - "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" - }, - "severity": { - "value": "[[[parameters('HybridVMHeartBeatRGAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('HybridVMHeartBeatRGWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('HybridVMHeartBeatRGEvaluationFrequency')]" - }, - "autoMitigate": { - "value": "[[[parameters('HybridVMHeartBeatRGAutoMitigate')]" - }, - "autoResolve": { - "value": "[[[parameters('HybridVMHeartBeatRGAutoResolve')]" - }, - "autoResolveTime": { - "value": "[[[parameters('HybridVMHeartBeatRGAutoResolveTime')]" - }, - "effect": { - "value": "[[[parameters('HybridVMHeartBeatRGPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('HybridVMHeartBeatRGAlertState')]" - }, - "threshold": { - "value": "[[[parameters('HybridVMHeartBeatRGThreshold')]" - }, - "operator": { - "value": "[[[parameters('HybridVMHeartBeatRGOperator')]" - }, - "timeAggregation": { - "value": "[[[parameters('HybridVMHeartBeatRGTimeAggregation')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_HybridVMNetworkIn", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_Hybrid_VM_NetworkIn_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('HybridVMNetworkInAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('HybridVMNetworkInWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('HybridVMNetworkInEvaluationFrequency')]" - }, - "autoMitigate": { - "value": "[[[parameters('HybridVMNetworkInAutoMitigate')]" - }, - "autoResolve": { - "value": "[[[parameters('HybridVMNetworkInAutoResolve')]" - }, - "autoResolveTime": { - "value": "[[[parameters('HybridVMNetworkInAutoResolveTime')]" - }, - "effect": { - "value": "[[[parameters('HybridVMNetworkInPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('HybridVMNetworkInAlertState')]" - }, - "threshold": { - "value": "[[[parameters('HybridVMNetworkInThreshold')]" - }, - "operator": { - "value": "[[[parameters('HybridVMNetworkInOperator')]" - }, - "timeAggregation": { - "value": "[[[parameters('HybridVMNetworkInTimeAggregation')]" - }, - "failingPeriods": { - "value": "[[[parameters('HybridVMNetworkInFailingPeriods')]" - }, - "evaluationPeriods": { - "value": "[[[parameters('HybridVMNetworkInEvaluationPeriods')]" - }, - "computersToInclude": { - "value": "[[[parameters('HybridVMNetworkInComputersToInclude')]" - }, - "networkInterfacesToInclude": { - "value": "[[[parameters('HybridVMNetworkInNetworkInterfaceToInclude')]" - }, - "alertResourceGroupName": { - "value": "[[[parameters('ALZMonitorResourceGroupName')]" - }, - "alertResourceGroupTags": { - "value": "[[[parameters('ALZMonitorResourceGroupTags')]" - }, - "alertResourceGroupLocation": { - "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_HybridVMNetworkOut", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_Hybrid_VM_NetworkOut_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('HybridVMNetworkOutAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('HybridVMNetworkOutWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('HybridVMNetworkOutEvaluationFrequency')]" - }, - "autoMitigate": { - "value": "[[[parameters('HybridVMNetworkOutAutoMitigate')]" - }, - "autoResolve": { - "value": "[[[parameters('HybridVMNetworkOutAutoResolve')]" - }, - "autoResolveTime": { - "value": "[[[parameters('HybridVMNetworkOutAutoResolveTime')]" - }, - "effect": { - "value": "[[[parameters('HybridVMNetworkOutPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('HybridVMNetworkOutAlertState')]" - }, - "threshold": { - "value": "[[[parameters('HybridVMNetworkOutThreshold')]" - }, - "operator": { - "value": "[[[parameters('HybridVMNetworkOutOperator')]" - }, - "timeAggregation": { - "value": "[[[parameters('HybridVMNetworkOutTimeAggregation')]" - }, - "failingPeriods": { - "value": "[[[parameters('HybridVMNetworkOutFailingPeriods')]" - }, - "evaluationPeriods": { - "value": "[[[parameters('HybridVMNetworkOutEvaluationPeriods')]" - }, - "computersToInclude": { - "value": "[[[parameters('HybridVMNetworkOutComputersToInclude')]" - }, - "networkInterfacesToInclude": { - "value": "[[[parameters('HybridVMNetworkOutNetworkInterfaceToInclude')]" - }, - "alertResourceGroupName": { - "value": "[[[parameters('ALZMonitorResourceGroupName')]" - }, - "alertResourceGroupTags": { - "value": "[[[parameters('ALZMonitorResourceGroupTags')]" - }, - "alertResourceGroupLocation": { - "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_HybridVMOSDiskReadLatency", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_Hybrid_VM_OSDiskreadLatency_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('HybridVMOSDiskReadLatencyAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('HybridVMOSDiskReadLatencyWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('HybridVMOSDiskReadLatencyEvaluationFrequency')]" - }, - "autoMitigate": { - "value": "[[[parameters('HybridVMOSDiskReadLatencyAutoMitigate')]" - }, - "autoResolve": { - "value": "[[[parameters('HybridVMOSDiskReadLatencyAutoResolve')]" - }, - "autoResolveTime": { - "value": "[[[parameters('HybridVMOSDiskReadLatencyAutoResolveTime')]" - }, - "effect": { - "value": "[[[parameters('HybridVMOSDiskReadLatencyPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('HybridVMOSDiskReadLatencyAlertState')]" - }, - "threshold": { - "value": "[[[parameters('HybridVMOSDiskReadLatencyThreshold')]" - }, - "operator": { - "value": "[[[parameters('HybridVMOSDiskReadLatencyOperator')]" - }, - "timeAggregation": { - "value": "[[[parameters('HybridVMOSDiskReadLatencyTimeAggregation')]" - }, - "failingPeriods": { - "value": "[[[parameters('HybridVMOSDiskReadLatencyFailingPeriods')]" - }, - "evaluationPeriods": { - "value": "[[[parameters('HybridVMOSDiskReadLatencyEvaluationPeriods')]" - }, - "computersToInclude": { - "value": "[[[parameters('HybridVMOSDiskReadLatencyComputersToInclude')]" - }, - "disksToInclude": { - "value": "[[[parameters('HybridVMOSDiskReadLatencyDisksToInclude')]" - }, - "alertResourceGroupName": { - "value": "[[[parameters('ALZMonitorResourceGroupName')]" - }, - "alertResourceGroupTags": { - "value": "[[[parameters('ALZMonitorResourceGroupTags')]" - }, - "alertResourceGroupLocation": { - "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_HybridVMOSDiskWriteLatency", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_Hybrid_VM_OSDiskwriteLatency_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('HybridVMOSDiskWriteLatencyAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('HybridVMOSDiskWriteLatencyWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('HybridVMOSDiskWriteLatencyEvaluationFrequency')]" - }, - "autoMitigate": { - "value": "[[[parameters('HybridVMOSDiskWriteLatencyAutoMitigate')]" - }, - "autoResolve": { - "value": "[[[parameters('HybridVMOSDiskWriteLatencyAutoResolve')]" - }, - "autoResolveTime": { - "value": "[[[parameters('HybridVMOSDiskWriteLatencyAutoResolveTime')]" - }, - "effect": { - "value": "[[[parameters('HybridVMOSDiskWriteLatencyPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('HybridVMOSDiskWriteLatencyAlertState')]" - }, - "threshold": { - "value": "[[[parameters('HybridVMOSDiskWriteLatencyThreshold')]" - }, - "operator": { - "value": "[[[parameters('HybridVMOSDiskWriteLatencyOperator')]" - }, - "timeAggregation": { - "value": "[[[parameters('HybridVMOSDiskWriteLatencyTimeAggregation')]" - }, - "failingPeriods": { - "value": "[[[parameters('HybridVMOSDiskWriteLatencyFailingPeriods')]" - }, - "evaluationPeriods": { - "value": "[[[parameters('HybridVMOSDiskWriteLatencyEvaluationPeriods')]" - }, - "computersToInclude": { - "value": "[[[parameters('HybridVMOSDiskWriteLatencyComputersToInclude')]" - }, - "disksToInclude": { - "value": "[[[parameters('HybridVMOSDiskWriteLatencyDisksToInclude')]" - }, - "alertResourceGroupName": { - "value": "[[[parameters('ALZMonitorResourceGroupName')]" - }, - "alertResourceGroupTags": { - "value": "[[[parameters('ALZMonitorResourceGroupTags')]" - }, - "alertResourceGroupLocation": { - "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_HybridVMOSDiskSpace", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_Hybrid_VM_OSDiskSpace_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('HybridVMOSDiskSpaceAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('HybridVMOSDiskSpaceWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('HybridVMOSDiskSpaceEvaluationFrequency')]" - }, - "autoMitigate": { - "value": "[[[parameters('HybridVMOSDiskSpaceAutoMitigate')]" - }, - "autoResolve": { - "value": "[[[parameters('HybridVMOSDiskSpaceAutoResolve')]" - }, - "autoResolveTime": { - "value": "[[[parameters('HybridVMOSDiskSpaceAutoResolveTime')]" - }, - "effect": { - "value": "[[[parameters('HybridVMOSDiskSpacePolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('HybridVMOSDiskSpaceAlertState')]" - }, - "threshold": { - "value": "[[[parameters('HybridVMOSDiskSpaceThreshold')]" - }, - "operator": { - "value": "[[[parameters('HybridVMOSDiskSpaceOperator')]" - }, - "timeAggregation": { - "value": "[[[parameters('HybridVMOSDiskSpaceTimeAggregation')]" - }, - "failingPeriods": { - "value": "[[[parameters('HybridVMOSDiskSpaceFailingPeriods')]" - }, - "evaluationPeriods": { - "value": "[[[parameters('HybridVMOSDiskSpaceEvaluationPeriods')]" - }, - "computersToInclude": { - "value": "[[[parameters('HybridVMOSDiskSpaceComputersToInclude')]" - }, - "disksToInclude": { - "value": "[[[parameters('HybridVMOSDiskSpaceDisksToInclude')]" - }, - "alertResourceGroupName": { - "value": "[[[parameters('ALZMonitorResourceGroupName')]" - }, - "alertResourceGroupTags": { - "value": "[[[parameters('ALZMonitorResourceGroupTags')]" - }, - "alertResourceGroupLocation": { - "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_HybridVMPercentCPU", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_Hybrid_VM_CPU_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('HybridVMPercentCPUAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('HybridVMPercentCPUWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('HybridVMPercentCPUEvaluationFrequency')]" - }, - "autoMitigate": { - "value": "[[[parameters('HybridVMPercentCPUAutoMitigate')]" - }, - "autoResolve": { - "value": "[[[parameters('HybridVMPercentCPUAutoResolve')]" - }, - "autoResolveTime": { - "value": "[[[parameters('HybridVMPercentCPUAutoResolveTime')]" - }, - "effect": { - "value": "[[[parameters('HybridVMPercentCPUPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('HybridVMPercentCPUAlertState')]" - }, - "threshold": { - "value": "[[[parameters('HybridVMPercentCPUThreshold')]" - }, - "operator": { - "value": "[[[parameters('HybridVMPercentCPUOperator')]" - }, - "timeAggregation": { - "value": "[[[parameters('HybridVMPercentCPUTimeAggregation')]" - }, - "alertResourceGroupName": { - "value": "[[[parameters('ALZMonitorResourceGroupName')]" - }, - "alertResourceGroupTags": { - "value": "[[[parameters('ALZMonitorResourceGroupTags')]" - }, - "alertResourceGroupLocation": { - "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_HybridVMPercentMemory", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_Hybrid_VM_Memory_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('HybridVMPercentMemoryAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('HybridVMPercentMemoryWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('HybridVMPercentMemoryEvaluationFrequency')]" - }, - "autoMitigate": { - "value": "[[[parameters('HybridVMPercentMemoryAutoMitigate')]" - }, - "autoResolve": { - "value": "[[[parameters('HybridVMPercentMemoryAutoResolve')]" - }, - "autoResolveTime": { - "value": "[[[parameters('HybridVMPercentMemoryAutoResolveTime')]" - }, - "effect": { - "value": "[[[parameters('HybridVMPercentMemoryPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('HybridVMPercentMemoryAlertState')]" - }, - "threshold": { - "value": "[[[parameters('HybridVMPercentMemoryThreshold')]" - }, - "operator": { - "value": "[[[parameters('HybridVMPercentMemoryOperator')]" - }, - "timeAggregation": { - "value": "[[[parameters('HybridVMPercentMemoryTimeAggregation')]" - }, - "alertResourceGroupName": { - "value": "[[[parameters('ALZMonitorResourceGroupName')]" - }, - "alertResourceGroupTags": { - "value": "[[[parameters('ALZMonitorResourceGroupTags')]" - }, - "alertResourceGroupLocation": { - "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_HybridVMDataDiskSpace", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_Hybrid_VM_dataDiskSpace_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('HybridVMDataDiskSpaceAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('HybridVMDataDiskSpaceWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('HybridVMDataDiskSpaceEvaluationFrequency')]" - }, - "autoMitigate": { - "value": "[[[parameters('HybridVMDataDiskSpaceAutoMitigate')]" - }, - "autoResolve": { - "value": "[[[parameters('HybridVMDataDiskSpaceAutoResolve')]" - }, - "autoResolveTime": { - "value": "[[[parameters('HybridVMDataDiskSpaceAutoResolveTime')]" - }, - "effect": { - "value": "[[[parameters('HybridVMDataDiskSpacePolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('HybridVMDataDiskSpaceAlertState')]" - }, - "threshold": { - "value": "[[[parameters('HybridVMDataDiskSpaceThreshold')]" - }, - "operator": { - "value": "[[[parameters('HybridVMDataDiskSpaceOperator')]" - }, - "timeAggregation": { - "value": "[[[parameters('HybridVMDataDiskSpaceTimeAggregation')]" - }, - "failingPeriods": { - "value": "[[[parameters('HybridVMDataDiskSpaceFailingPeriods')]" - }, - "evaluationPeriods": { - "value": "[[[parameters('HybridVMDataDiskSpaceEvaluationPeriods')]" - }, - "disksToInclude": { - "value": "[[[parameters('HybridVMDataDiskSpaceDisksToInclude')]" - }, - "alertResourceGroupName": { - "value": "[[[parameters('ALZMonitorResourceGroupName')]" - }, - "alertResourceGroupTags": { - "value": "[[[parameters('ALZMonitorResourceGroupTags')]" - }, - "alertResourceGroupLocation": { - "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_HybridVMDataDiskReadLatency", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_Hybrid_VM_dataDiskReadLatency_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('HybridVMDataDiskReadLatencyAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('HybridVMDataDiskReadLatencyWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('HybridVMDataDiskReadLatencyEvaluationFrequency')]" - }, - "autoMitigate": { - "value": "[[[parameters('HybridVMDataDiskReadLatencyAutoMitigate')]" - }, - "autoResolve": { - "value": "[[[parameters('HybridVMDataDiskReadLatencyAutoResolve')]" - }, - "autoResolveTime": { - "value": "[[[parameters('HybridVMDataDiskReadLatencyAutoResolveTime')]" - }, - "effect": { - "value": "[[[parameters('HybridVMDataDiskReadLatencyPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('HybridVMDataDiskReadLatencyAlertState')]" - }, - "threshold": { - "value": "[[[parameters('HybridVMDataDiskReadLatencyThreshold')]" - }, - "operator": { - "value": "[[[parameters('HybridVMDataDiskReadLatencyOperator')]" - }, - "timeAggregation": { - "value": "[[[parameters('HybridVMDataDiskReadLatencyTimeAggregation')]" - }, - "failingPeriods": { - "value": "[[[parameters('HybridVMDataDiskReadLatencyFailingPeriods')]" - }, - "evaluationPeriods": { - "value": "[[[parameters('HybridVMDataDiskReadLatencyEvaluationPeriods')]" - }, - "computersToInclude": { - "value": "[[[parameters('HybridVMDataDiskReadLatencyComputersToInclude')]" - }, - "disksToInclude": { - "value": "[[[parameters('HybridVMDataDiskReadLatencyDisksToInclude')]" - }, - "alertResourceGroupName": { - "value": "[[[parameters('ALZMonitorResourceGroupName')]" - }, - "alertResourceGroupTags": { - "value": "[[[parameters('ALZMonitorResourceGroupTags')]" - }, - "alertResourceGroupLocation": { - "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_HybridVMDataDiskWriteLatency", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_Hybrid_VM_dataDiskWriteLatency_Alert", - "parameters": { - "severity": { - "value": "[[[parameters('HybridVMDataDiskWriteLatencyAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('HybridVMDataDiskWriteLatencyWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('HybridVMDataDiskWriteLatencyEvaluationFrequency')]" - }, - "autoMitigate": { - "value": "[[[parameters('HybridVMDataDiskWriteLatencyAutoMitigate')]" - }, - "autoResolve": { - "value": "[[[parameters('HybridVMDataDiskWriteLatencyAutoResolve')]" - }, - "autoResolveTime": { - "value": "[[[parameters('HybridVMDataDiskWriteLatencyAutoResolveTime')]" - }, - "effect": { - "value": "[[[parameters('HybridVMDataDiskWriteLatencyPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('HybridVMDataDiskWriteLatencyAlertState')]" - }, - "threshold": { - "value": "[[[parameters('HybridVMDataDiskWriteLatencyThreshold')]" - }, - "operator": { - "value": "[[[parameters('HybridVMDataDiskWriteLatencyOperator')]" - }, - "timeAggregation": { - "value": "[[[parameters('HybridVMDataDiskWriteLatencyTimeAggregation')]" - }, - "failingPeriods": { - "value": "[[[parameters('HybridVMDataDiskWriteLatencyFailingPeriods')]" - }, - "evaluationPeriods": { - "value": "[[[parameters('HybridVMDataDiskWriteLatencyEvaluationPeriods')]" - }, - "computersToInclude": { - "value": "[[[parameters('HybridVMDataDiskWriteLatencyComputersToInclude')]" - }, - "disksToInclude": { - "value": "[[[parameters('HybridVMDataDiskWriteLatencyDisksToInclude')]" - }, - "alertResourceGroupName": { - "value": "[[[parameters('ALZMonitorResourceGroupName')]" - }, - "alertResourceGroupTags": { - "value": "[[[parameters('ALZMonitorResourceGroupTags')]" - }, - "alertResourceGroupLocation": { - "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" - } - } - }, - { - "policyDefinitionReferenceId": "ALZ_HybridVMDisconnected", - "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_Hybrid_VM_Disconnected_Alert", - "parameters": { - "userAssignedManagedIdentityName": { - "value": "[[[parameters('ALZUserAssignedManagedIdentityName')]" - }, - "managementSubscriptionId": { - "value": "[[[parameters('ALZManagementSubscriptionId')]" - }, - "BYOUserAssignedManagedIdentityResourceId": { - "value": "[[[parameters('BYOUserAssignedManagedIdentityResourceId')]" - }, - "severity": { - "value": "[[[parameters('HybridVMDisconnectedAlertSeverity')]" - }, - "windowSize": { - "value": "[[[parameters('HybridVMDisconnectedAlertWindowSize')]" - }, - "evaluationFrequency": { - "value": "[[[parameters('HybridVMDisconnectedAlertEvaluationFrequency')]" - }, - "autoMitigate": { - "value": "[[[parameters('HybridVMDisconnectedAlertAutoMitigate')]" - }, - "effect": { - "value": "[[[parameters('HybridVMDisconnectedAlertPolicyEffect')]" - }, - "enabled": { - "value": "[[[parameters('HybridVMDisconnectedAlertState')]" - }, - "threshold": { - "value": "[[[parameters('HybridVMDisconnectedAlertDaysThreshold')]" - }, - "operator": { - "value": "[[[parameters('HybridVMDisconnectedAlertOperator')]" - }, - "timeAggregation": { - "value": "[[[parameters('HybridVMDisconnectedAlertTimeAggregation')]" - }, - "failingPeriods": { - "value": "[[[parameters('HybridVMDisconnectedAlertFailingPeriods')]" - }, - "evaluationPeriods": { - "value": "[[[parameters('HybridVMDisconnectedAlertEvaluationPeriods')]" - }, - "alertResourceGroupName": { - "value": "[[[parameters('ALZMonitorResourceGroupName')]" - }, - "alertResourceGroupTags": { - "value": "[[[parameters('ALZMonitorResourceGroupTags')]" - }, - "alertResourceGroupLocation": { - "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" - } - } - } - ], - "policyType": "Custom", - "policyDefinitionGroups": null - } - }, - "$fxv#13": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_ERP_ExpressRouteBitsIn_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy ER Direct ExpressRoute Bits In Alert\",\r\n \"description\": \"Policy to audit/deploy ER Direct Connection BitsInPerSecond Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.1\",\r\n \"category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"0\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"disabled\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/expressRoutePorts\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/expressRoutePorts\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"PortBitsInPerSecond\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/expressRoutePorts/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"LessThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-DirectERBitsInAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for ER Direct Connection BitsInPerSecond\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"PortBitsInPerSecond\",\r\n \"metricNamespace\": \"Microsoft.Network/expressRoutePorts\",\r\n \"metricName\": \"PortBitsInPerSecond\",\r\n \"operator\": \"LessThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#14": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_ERP_ExpressRouteBitsOut_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy ER Direct ExpressRoute Bits Out Alert\",\r\n \"description\": \"Policy to audit/deploy ER Direct Connection BitsOutPerSecond Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.1\",\r\n \"category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"0\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"disabled\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/expressRoutePorts\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/expressRoutePorts\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"PortBitsOutPerSecond\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/expressRoutePorts/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"LessThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-DirectERBitsOutAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for ER Direct Connection BitsOutPerSecond\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"PortBitsOutPerSecond\",\r\n \"metricNamespace\": \"Microsoft.Network/expressRoutePorts\",\r\n \"metricName\": \"PortBitsOutPerSecond\",\r\n \"operator\": \"LessThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#15": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_ERP_ExpressRoutLineProtocol_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy ER Direct ExpressRoute LineProtocol Alert\",\r\n \"description\": \"Policy to audit/deploy ER Direct LineProtocol Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.1\",\r\n \"category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"0\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"0.9\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"disabled\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/expressRoutePorts\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/expressRoutePorts\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"LineProtocol\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/expressRoutePorts/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"LessThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-DirectERLineProtocolAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for ER Direct Connection LineProtocolPerSecond\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"LineProtocol\",\r\n \"metricNamespace\": \"Microsoft.Network/expressRoutePorts\",\r\n \"metricName\": \"LineProtocol\",\r\n \"operator\": \"LessThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#16": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_ERP_ExpressRoutRxLightLevel_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy ER Direct ExpressRoute RxLightLevel High Alert\",\r\n \"description\": \"Policy to audit/deploy ER Direct RxLightLevel High Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.0\",\r\n \"category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"1\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"0\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"disabled\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/expressRoutePorts\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/expressRoutePorts\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"RxLightLevel\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/expressRoutePorts/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-DirectERRxLightLevelHighAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for ER Direct Connection RxLightLevelHigh\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"RxLightLevel\",\r\n \"metricNamespace\": \"Microsoft.Network/expressRoutePorts\",\r\n \"metricName\": \"RxLightLevel\",\r\n \"operator\": \"GreaterThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#17": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_ERP_ExpressRoutRxLightLevellow_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy ER Direct ExpressRoute RxLightLevel Low Alert\",\r\n \"description\": \"Policy to audit/deploy ER Direct RxLightLevel Low Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.1\",\r\n \"category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"1\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"-10\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"disabled\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/expressRoutePorts\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/expressRoutePorts\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"RxLightLevel\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"LessThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/expressRoutePorts/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"LessThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-DirectERRxLightLevelLowAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for ER Direct Connection RxLightLevelLow\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"RxLightLevel\",\r\n \"metricNamespace\": \"Microsoft.Network/expressRoutePorts\",\r\n \"metricName\": \"RxLightLevel\",\r\n \"operator\": \"LessThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#18": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_ERP_ExpressRoutTxLightLevell_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy ER Direct ExpressRoute TxLightLevel High Alert\",\r\n \"description\": \"Policy to audit/deploy ER Direct TxLightLevel High Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.1\",\r\n \"category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"1\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"0\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"disabled\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/expressRoutePorts\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/expressRoutePorts\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"TxLightLevel\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/expressRoutePorts/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-DirectERTxLightLevelHighAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for ER Direct Connection TxLightLevelHigh\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"TxLightLevel\",\r\n \"metricNamespace\": \"Microsoft.Network/expressRoutePorts\",\r\n \"metricName\": \"TxLightLevel\",\r\n \"operator\": \"GreaterThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#19": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_ERP_ExpressRoutTxLightLevellow_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy ER Direct ExpressRoute TxLightLevel Low Alert\",\r\n \"description\": \"Policy to audit/deploy ER Direct TxLightLevel Low Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.1\",\r\n \"category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"1\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"-10\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"disabled\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/expressRoutePorts\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/expressRoutePorts\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"TxLightLevel\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"LessThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/expressRoutePorts/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"LessThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-DirectERTxLightLevelLowAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for ER Direct Connection TxLightLevelLow\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"TxLightLevel\",\r\n \"metricNamespace\": \"Microsoft.Network/expressRoutePorts\",\r\n \"metricName\": \"TxLightLevel\",\r\n \"operator\": \"LessThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#2": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_activitylog_RouteTable_Update\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Activity Log Route Table Update Alert\",\r\n \"description\": \"Policy to Deploy Activity Log Route Table Update Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.0.1\",\r\n \"category\": \"Network\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"AlzMonitoring-rg\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"environment\": \"test\",\r\n \"_deployed_by_amba\": true\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring on resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/routeTables\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"deployIfNotExists\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/activityLogAlerts\",\r\n \"name\": \"ActivityUDRUpdate\",\r\n \"existenceScope\": \"resourcegroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"count\": {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*]\",\r\n \"where\": {\r\n \"anyOf\": [\r\n {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].field\",\r\n \"equals\": \"category\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].equals\",\r\n \"equals\": \"Administrative\"\r\n }\r\n ]\r\n },\r\n {\r\n \"allOf\": [\r\n {\r\n \"field\": \"microsoft.insights/activityLogAlerts/condition.allOf[*].field\",\r\n \"equals\": \"operationName\"\r\n },\r\n {\r\n \"field\": \"microsoft.insights/activityLogAlerts/condition.allOf[*].equals\",\r\n \"equals\": \"Microsoft.Network/routeTables/routes/write\"\r\n }\r\n ]\r\n }\r\n ]\r\n }\r\n },\r\n \"equals\": 2\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"ActivityUDRUpdate\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"microsoft.insights/activityLogAlerts\",\r\n \"apiVersion\": \"2020-10-01\",\r\n \"name\": \"ActivityUDRUpdate\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Activity Log Route table update\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().id]\"\r\n ],\r\n \"condition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"category\",\r\n \"equals\": \"Administrative\"\r\n },\r\n {\r\n \"field\": \"operationName\",\r\n \"equals\": \"Microsoft.Network/routeTables/routes/write\"\r\n },\r\n {\r\n \"field\": \"status\",\r\n \"containsAny\": [\r\n \"succeeded\"\r\n ]\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#20": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VnetGw_ExpressRouteBitsPerSecond_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VNetG ExpressRoute Bits Per Second Alert\",\r\n \"description\": \"Policy to audit/deploy Virtual Network Gateway Express Route Bits Per Second Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.0\",\r\n \"category\": \"Network\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"0\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT1M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/virtualNetworkGateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Network/virtualNetworkGateways/gatewayType\",\r\n \"equals\": \"ExpressRoute\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/virtualNetworkGateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"ExpressRouteGatewayBitsPerSecond\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/virtualNetworkGateways/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].operator\",\r\n \"equals\": \"LessThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-GatewayERBitsAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for VNet Gateway Express Route Bits Per Second\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"ExpressRouteGatewayBitsPerSecond\",\r\n \"metricNamespace\": \"Microsoft.Network/virtualNetworkGateways\",\r\n \"metricName\": \"ExpressRouteGatewayBitsPerSecond\",\r\n \"operator\": \"LessThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#21": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VnetGw_ExpressRouteCpuUtil_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VNetG ExpressRoute CPU Utilization Alert\",\r\n \"description\": \"Policy to audit/deploy Virtual Network Gateway Express Route CPU Utilization Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.0\",\r\n \"category\": \"Network\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"1\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT1M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"80\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/virtualNetworkGateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Network/virtualNetworkGateways/gatewayType\",\r\n \"equals\": \"ExpressRoute\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/virtualNetworkGateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"ExpressRouteGatewayCpuUtilization\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/virtualNetworkGateways/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-GatewayERCPUAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for VNet Gateway Express Route CPU Utilization\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"ExpressRouteGatewayCpuUtilization\",\r\n \"metricNamespace\": \"Microsoft.Network/virtualNetworkGateways\",\r\n \"metricName\": \"ExpressRouteGatewayCpuUtilization\",\r\n \"operator\": \"GreaterThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#22": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_PDNSZ_CapacityUtil_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy PDNSZ Capacity Utilization Alert\",\r\n \"description\": \"Policy to audit/deploy Private DNS Zone Capacity Utilization Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.0\",\r\n \"category\": \"Network\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT1H\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT1H\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"80\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/privateDnsZones\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/privateDnsZones\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"VirtualNetworkLinkCapacityUtilization\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/privateDnsZones/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Maximum\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThanOrEqual\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-CapacityUtilizationAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for Private DNS Zone Virtual Network Link Capacity Utilization\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"VirtualNetworkLinkCapacityUtilization\",\r\n \"metricNamespace\": \"Microsoft.Network/privateDnsZones\",\r\n \"metricName\": \"VirtualNetworkLinkCapacityUtilization\",\r\n \"operator\": \"GreaterThanOrEqual\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Maximum\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#23": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_PDNSZ_QueryVolume_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy PDNSZ Query Volume Alert\",\r\n \"description\": \"Policy to audit/deploy Private DNS Zone Query Volume Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.0\",\r\n \"category\": \"Network\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"4\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT1H\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT1H\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"500\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"disabled\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/privateDnsZones\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/privateDnsZones\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"QueryVolume\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/privateDnsZones/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Total\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThanOrEqual\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-QueryVolumeAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for Private DNS Query Volume\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"QueryVolume\",\r\n \"metricNamespace\": \"Microsoft.Network/privateDnsZones\",\r\n \"metricName\": \"QueryVolume\",\r\n \"operator\": \"GreaterThanOrEqual\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Total\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#24": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_PDNSZ_RecordSetCapacity_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy PDNSZ Record Set Capacity Alert\",\r\n \"description\": \"Policy to audit/deploy Private DNS Zone Record Set Capacity Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.0\",\r\n \"category\": \"Network\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT1H\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT1H\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"80\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/privateDnsZones\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/privateDnsZones\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"RecordSetCapacityUtilization\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/privateDnsZones/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Maximum\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThanOrEqual\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-RecordSet_Capacity_Utilization')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for Private DNS Zone Record Set Capacity Utilization\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"RecordSetCapacityUtilization\",\r\n \"metricNamespace\": \"Microsoft.Network/privateDnsZones\",\r\n \"metricName\": \"RecordSetCapacityUtilization\",\r\n \"operator\": \"GreaterThanOrEqual\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Maximum\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#25": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_DNSZ_RegistrationCapacityUtil_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy PDNSZ Registration Capacity Utilization Alert\",\r\n \"description\": \"Policy to audit/deploy Private DNS Zone Registration Capacity Utilization Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.0\",\r\n \"category\": \"Network\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT1H\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT1H\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"80\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/privateDnsZones\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/privateDnsZones\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"VirtualNetworkWithRegistrationCapacityUtilization\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/privateDnsZones/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Maximum\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThanOrEqual\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-RequestsAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for Private DNS Zone Registration Capacity Utilization\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"VirtualNetworkWithRegistrationCapacityUtilization\",\r\n \"metricNamespace\": \"Microsoft.Network/privateDnsZones\",\r\n \"metricName\": \"VirtualNetworkWithRegistrationCapacityUtilization\",\r\n \"operator\": \"GreaterThanOrEqual\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Maximum\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#26": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VnetGw_TunnelBandwidth_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VNetG Tunnel Bandwidth Alert\",\r\n \"description\": \"Policy to audit/deploy Virtual Network Gateway Tunnel Bandwidth Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.0\",\r\n \"category\": \"Network\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"0\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT1M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/virtualNetworkGateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Network/virtualNetworkGateways/gatewayType\",\r\n \"equals\": \"VPN\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/virtualNetworkGateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"TunnelAverageBandwidth\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/virtualNetworkGateways/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].operator\",\r\n \"equals\": \"LessThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-TunnelBandwidthAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for VNet Gateway Tunnel Avg Bandwidth\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"TunnelAverageBandwidth\",\r\n \"metricNamespace\": \"Microsoft.Network/virtualNetworkGateways\",\r\n \"metricName\": \"TunnelAverageBandwidth\",\r\n \"operator\": \"LessThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#27": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VnetGw_TunnelEgress_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VNetG Tunnel Egress Alert\",\r\n \"description\": \"Policy to audit/deploy Virtual Network Gateway Tunnel Egress Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.0\",\r\n \"category\": \"Network\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"0\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"disabled\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/virtualNetworkGateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Network/virtualNetworkGateways/gatewayType\",\r\n \"equals\": \"VPN\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/virtualNetworkGateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"TunnelEgressBytes\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/virtualNetworkGateways/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].operator\",\r\n \"equals\": \"LessThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-TunnelEgressAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for VNet Gateway Tunnel Egress Bytes\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"TunnelEgressBytes\",\r\n \"metricNamespace\": \"Microsoft.Network/virtualNetworkGateways\",\r\n \"metricName\": \"TunnelEgressBytes\",\r\n \"operator\": \"LessThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#28": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VnetGw_TunnelEgressPacketDropCount_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VNetG Egress Packet Drop Count Alert\",\r\n \"description\": \"Policy to audit/deploy Vnet Gateway Egress Packet Drop Count Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.0\",\r\n \"category\": \"Network\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"3\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Monitoring disabled\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"microsoft.network/virtualNetworkGateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Network/virtualNetworkGateways/gatewayType\",\r\n \"equals\": \"VPN\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"microsoft.network/virtualNetworkGateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"TunnelEgressPacketDropCount\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/microsoft.network/virtualNetworkGateways/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\r\n \"equals\": \"Medium\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": 4\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": 4\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-TunnelEgressPacketDropCountAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for Vnet Gateway tunnel TunnelEgressPacketDropCount\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"alertSensitivity\": \"Medium\",\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": 4,\r\n \"minFailingPeriodsToAlert\": 4\r\n },\r\n \"name\": \"TunnelEgressPacketDropCount\",\r\n \"metricNamespace\": \"microsoft.network/virtualNetworkGateways\",\r\n \"metricName\": \"TunnelEgressPacketDropCount\",\r\n \"operator\": \"GreaterThan\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"DynamicThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#29": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VnetGw_TunnelEgressPacketDropMismatch_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VNetG Egress Packet Drop Mismatch Alert\",\r\n \"description\": \"Policy to audit/deploy Vnet Gateway Egress Packet Drop Mismatch Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.0\",\r\n \"category\": \"Network\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"3\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Monitoring disabled\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"microsoft.network/virtualNetworkGateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Network/virtualNetworkGateways/gatewayType\",\r\n \"equals\": \"VPN\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"microsoft.network/virtualNetworkGateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"TunnelEgressPacketDropTSMismatch\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/microsoft.network/virtualNetworkGateways/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\r\n \"equals\": \"Medium\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": 4\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": 4\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-TunnelEgressPacketDropTSMismatchAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for Vnet Gateway tunnel TunnelEgressPacketDropTSMismatch\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"alertSensitivity\": \"Medium\",\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": 4,\r\n \"minFailingPeriodsToAlert\": 4\r\n },\r\n \"name\": \"TunnelEgressPacketDropTSMismatch\",\r\n \"metricNamespace\": \"microsoft.network/virtualNetworkGateways\",\r\n \"metricName\": \"TunnelEgressPacketDropTSMismatch\",\r\n \"operator\": \"GreaterThan\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"DynamicThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#3": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_activitylog_VPNGateway_Delete\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Activity Log VPN Gateway Delete Alert\",\r\n \"description\": \"Policy to Deploy Activity Log VPN Gateway Delete Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.0.1\",\r\n \"category\": \"Network\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"AlzMonitoring-rg\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"environment\": \"test\",\r\n \"_deployed_by_amba\": true\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/vpnGateways\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"deployIfNotExists\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/activityLogAlerts\",\r\n \"existenceScope\": \"resourcegroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"count\": {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*]\",\r\n \"where\": {\r\n \"anyOf\": [\r\n {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].field\",\r\n \"equals\": \"category\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].equals\",\r\n \"equals\": \"Administrative\"\r\n }\r\n ]\r\n },\r\n {\r\n \"allOf\": [\r\n {\r\n \"field\": \"microsoft.insights/activityLogAlerts/condition.allOf[*].field\",\r\n \"equals\": \"operationName\"\r\n },\r\n {\r\n \"field\": \"microsoft.insights/activityLogAlerts/condition.allOf[*].equals\",\r\n \"equals\": \"Microsoft.Network/vpnGateways/delete\"\r\n }\r\n ]\r\n }\r\n ]\r\n }\r\n },\r\n \"equals\": 2\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"ActivityVPNGatewayDelete\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"microsoft.insights/activityLogAlerts\",\r\n \"apiVersion\": \"2020-10-01\",\r\n \"name\": \"ActivityVPNGatewayDelete\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Activity Log VPN Gateway Delete\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().id]\"\r\n ],\r\n \"condition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"category\",\r\n \"equals\": \"Administrative\"\r\n },\r\n {\r\n \"field\": \"operationName\",\r\n \"equals\": \"Microsoft.Network/vpnGateways/delete\"\r\n },\r\n {\r\n \"field\": \"status\",\r\n \"containsAny\": [\r\n \"succeeded\"\r\n ]\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#30": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VnetGw_TunnelIngress_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VNetG Tunnel Ingress Alert\",\r\n \"description\": \"Policy to audit/deploy Virtual Network Gateway Tunnel Ingress Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.0\",\r\n \"category\": \"Network\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"0\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"disabled\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/virtualNetworkGateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Network/virtualNetworkGateways/gatewayType\",\r\n \"equals\": \"VPN\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/virtualNetworkGateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"TunnelIngressBytes\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/virtualNetworkGateways/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].operator\",\r\n \"equals\": \"LessThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-TunnelIngressAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for VNet Gateway Tunnel ingress Bytes\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"TunnelIngressBytes\",\r\n \"metricNamespace\": \"Microsoft.Network/virtualNetworkGateways\",\r\n \"metricName\": \"TunnelIngressBytes\",\r\n \"operator\": \"LessThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#31": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VnetGw_TunnelIngressPacketDropCount_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VNetG Ingress Packet Drop Count Alert\",\r\n \"description\": \"Policy to audit/deploy Vnet Gateway Ingress Packet Drop Count Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.0\",\r\n \"category\": \"Network\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"3\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Monitoring disabled\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"microsoft.network/virtualNetworkGateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Network/virtualNetworkGateways/gatewayType\",\r\n \"equals\": \"VPN\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"microsoft.network/virtualNetworkGateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"TunnelIngressPacketDropCount\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/microsoft.network/virtualNetworkGateways/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\r\n \"equals\": \"Medium\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": 4\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": 4\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-TunnelIngressPacketDropCountAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for Vnet Gateway tunnel TunnelIngressPacketDropCount\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"alertSensitivity\": \"Medium\",\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": 4,\r\n \"minFailingPeriodsToAlert\": 4\r\n },\r\n \"name\": \"TunnelIngressPacketDropCount\",\r\n \"metricNamespace\": \"microsoft.network/virtualNetworkGateways\",\r\n \"metricName\": \"TunnelIngressPacketDropCount\",\r\n \"operator\": \"GreaterThan\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"DynamicThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#32": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VnetGw_TunnelIngressPacketDropMismatch_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VNetG Ingress Packet Drop Mismatch Alert\",\r\n \"description\": \"Policy to audit/deploy Vnet Gateway Ingress Packet Drop Mismatch Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.0\",\r\n \"category\": \"Network\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"3\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Monitoring disabled\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"microsoft.network/virtualNetworkGateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Network/virtualNetworkGateways/gatewayType\",\r\n \"equals\": \"VPN\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"microsoft.network/virtualNetworkGateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"TunnelIngressPacketDropTSMismatch\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/microsoft.network/virtualNetworkGateways/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\r\n \"equals\": \"Medium\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": 4\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": 4\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-TunnelIngressPacketDropTSMismatchAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for Vnet Gateway tunnel TunnelIngressPacketDropTSMismatch\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"alertSensitivity\": \"Medium\",\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": 4,\r\n \"minFailingPeriodsToAlert\": 4\r\n },\r\n \"name\": \"TunnelIngressPacketDropTSMismatch\",\r\n \"metricNamespace\": \"microsoft.network/virtualNetworkGateways\",\r\n \"metricName\": \"TunnelIngressPacketDropTSMismatch\",\r\n \"operator\": \"GreaterThan\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"DynamicThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#33": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VPNGw_BandwidthUtil_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VPNG Bandwidth Utilization Alert\",\r\n \"description\": \"Policy to audit/deploy VPN Gateway Bandwidth Utilization Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.0\",\r\n \"category\": \"Network\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"0\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT1M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"microsoft.network/vpngateways\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"microsoft.network/vpngateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"tunnelaveragebandwidth\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/microsoft.network/vpngateways/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].operator\",\r\n \"equals\": \"LessThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-GatewayBandwidthAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for VPN Gateway Bandwidth Utilization\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"tunnelaveragebandwidth\",\r\n \"metricNamespace\": \"microsoft.network/vpngateways\",\r\n \"metricName\": \"tunnelaveragebandwidth\",\r\n \"operator\": \"LessThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#34": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VPNGw_BGPPeerStatus_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VPNG BGP Peer Status Alert\",\r\n \"description\": \"Policy to audit/deploy VPN Gateway BGP Peer Status Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.0\",\r\n \"category\": \"Network\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"0\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT1M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"microsoft.network/vpngateways\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"microsoft.network/vpngateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"bgppeerstatus\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/microsoft.network/vpngateways/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Total\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].operator\",\r\n \"equals\": \"LessThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-BGPPeerStatusAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for VPN Gateway BGP peer status\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"bgppeerstatus\",\r\n \"metricNamespace\": \"microsoft.network/vpngateways\",\r\n \"metricName\": \"bgppeerstatus\",\r\n \"operator\": \"LessThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Total\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#35": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VPNGw_Egress_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VPNG Egress Alert\",\r\n \"description\": \"Policy to audit/deploy VPN Gateway Egress Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.0\",\r\n \"category\": \"Network\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"0\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"disabled\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"microsoft.network/vpngateways\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"microsoft.network/vpngateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"tunnelegressbytes\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/microsoft.network/vpngateways/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].operator\",\r\n \"equals\": \"LessThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-TunnelEgressAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for VPN Gateway tunnel egress bytes\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"tunnelegressbytes\",\r\n \"metricNamespace\": \"microsoft.network/vpngateways\",\r\n \"metricName\": \"tunnelegressbytes\",\r\n \"operator\": \"LessThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#36": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VPNGw_TunnelEgressPacketDropCount_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VPNG Egress Packet Drop Count Alert\",\r\n \"description\": \"Policy to audit/deploy VPN Gateway Egress Packet Drop Count Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.0\",\r\n \"category\": \"Network\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"3\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"microsoft.network/vpngateways\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"microsoft.network/vpngateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"TunnelEgressPacketDropCount\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/microsoft.network/vpngateways/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\r\n \"equals\": \"Medium\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": 2\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": 2\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-TunnelEgressPacketDropCountAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for VPN Gateway tunnel TunnelEgressPacketDropCount\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"alertSensitivity\": \"Medium\",\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": 4,\r\n \"minFailingPeriodsToAlert\": 4\r\n },\r\n \"name\": \"TunnelEgressPacketDropCount\",\r\n \"metricNamespace\": \"microsoft.network/vpngateways\",\r\n \"metricName\": \"TunnelEgressPacketDropCount\",\r\n \"operator\": \"GreaterThan\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"DynamicThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#37": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VPNGw_TunnelEgressPacketDropMismatch_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VPNG Egress Packet Drop Mismatch Alert\",\r\n \"description\": \"Policy to audit/deploy VPN Gateway Egress Packet Drop Mismatch Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.0\",\r\n \"category\": \"Network\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"3\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"microsoft.network/vpngateways\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"microsoft.network/vpngateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"TunnelEgressPacketDropTSMismatch\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/microsoft.network/vpngateways/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\r\n \"equals\": \"Medium\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": 2\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": 2\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-TunnelEgressPacketDropTSMismatchAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for VPN Gateway tunnel TunnelEgressPacketDropTSMismatch\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"alertSensitivity\": \"Medium\",\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": 4,\r\n \"minFailingPeriodsToAlert\": 4\r\n },\r\n \"name\": \"TunnelEgressPacketDropTSMismatch\",\r\n \"metricNamespace\": \"microsoft.network/vpngateways\",\r\n \"metricName\": \"TunnelEgressPacketDropTSMismatch\",\r\n \"operator\": \"GreaterThan\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"DynamicThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#38": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VPNGw_Ingress_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VPNG Ingress Alert\",\r\n \"description\": \"Policy to audit/deploy VPN Gateway Ingress Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.0\",\r\n \"category\": \"Network\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"0\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"disabled\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"microsoft.network/vpngateways\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"microsoft.network/vpngateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"tunnelingressbytes\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/microsoft.network/vpngateways/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].operator\",\r\n \"equals\": \"LessThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-TunnelIngressAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for VPN Gateway tunnel ingress bytes\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"tunnelingressbytes\",\r\n \"metricNamespace\": \"microsoft.network/vpngateways\",\r\n \"metricName\": \"tunnelingressbytes\",\r\n \"operator\": \"LessThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#39": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VPNGw_TunnelIngressPacketDropCount_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VPNG Ingress Packet Drop Count Alert\",\r\n \"description\": \"Policy to audit/deploy VPN Gateway Ingress Packet Drop Count Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.0\",\r\n \"category\": \"Network\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"3\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"microsoft.network/vpngateways\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"microsoft.network/vpngateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"TunnelIngressPacketDropCount\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/microsoft.network/vpngateways/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\r\n \"equals\": \"Medium\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": 2\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": 2\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-TunnelIngressPacketDropCountAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for VPN Gateway tunnel TunnelIngressPacketDropCount\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"alertSensitivity\": \"Medium\",\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": 4,\r\n \"minFailingPeriodsToAlert\": 4\r\n },\r\n \"name\": \"TunnelIngressPacketDropCount\",\r\n \"metricNamespace\": \"microsoft.network/vpngateways\",\r\n \"metricName\": \"TunnelIngressPacketDropCount\",\r\n \"operator\": \"GreaterThan\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"DynamicThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#4": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_AFW_FirewallHealth_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy AFW FirewallHealth Alert\",\r\n \"description\": \"Policy to audit/deploy Azure Firewall FirewallHealth Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.0\",\r\n \"category\": \"Network\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"0\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT1M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"90\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/azureFirewalls\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/azureFirewalls\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"FirewallHealth\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/azureFirewalls/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"LessThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-FirewallHealth')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for AFW FirewallHealth\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"FirewallHealth\",\r\n \"metricNamespace\": \"Microsoft.Network/azureFirewalls\",\r\n \"metricName\": \"FirewallHealth\",\r\n \"operator\": \"LessThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#40": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VPNGw_TunnelIngressPacketDropMismatch_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VPNG Ingress Packet Drop Mismatch Alert\",\r\n \"description\": \"Policy to audit/deploy VPN Gateway Ingress Packet Drop Mismatch Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.0\",\r\n \"category\": \"Network\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"3\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"microsoft.network/vpngateways\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"microsoft.network/vpngateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"TunnelIngressPacketDropTSMismatch\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/microsoft.network/vpngateways/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\r\n \"equals\": \"Medium\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": 2\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": 2\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-TunnelIngressPacketDropTSMismatchAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for VPN Gateway tunnel TunnelIngressPacketDropTSMismatch\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"alertSensitivity\": \"Medium\",\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": 4,\r\n \"minFailingPeriodsToAlert\": 4\r\n },\r\n \"name\": \"TunnelIngressPacketDropTSMismatch\",\r\n \"metricNamespace\": \"microsoft.network/vpngateways\",\r\n \"metricName\": \"TunnelIngressPacketDropTSMismatch\",\r\n \"operator\": \"GreaterThan\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"DynamicThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#41": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_AG_ApplicationGatewayTotalTime_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy AGW ApplicationGatewayTotalTime Alert\",\r\n \"description\": \"Policy to audit/deploy Azure Application Gateway ApplicationGatewayTotalTime Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.3.0\",\r\n \"category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT1M\"\r\n },\r\n \"alertSensitivity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert Sensitivity\",\r\n \"description\": \"Alert Sensitivity for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"Low\",\r\n \"Medium\",\r\n \"High\"\r\n ],\r\n \"defaultValue\": \"Medium\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/applicationgateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Network/applicationgateways/sku.name\",\r\n \"In\": [\r\n \"Standard_v2\",\r\n \"WAF_v2\"\r\n ]\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/applicationgateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"ApplicationGatewayTotalTime\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/applicationgateways/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\r\n \"equals\": \"[[parameters('alertSensitivity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": 2\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": 2\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"alertSensitivity\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-agApplicationGatewayTotalTime')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for App Gateway ApplicationGatewayTotalTime\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"ApplicationGatewayTotalTime\",\r\n \"metricNamespace\": \"Microsoft.Network/applicationgateways\",\r\n \"metricName\": \"ApplicationGatewayTotalTime\",\r\n \"operator\": \"GreaterThan\",\r\n \"alertSensitivity\": \"[[parameters('alertSensitivity')]\",\r\n \"failingPeriods\": {\r\n \"minFailingPeriodsToAlert\": 2,\r\n \"numberOfEvaluationPeriods\": 2\r\n },\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"DynamicThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"alertSensitivity\": {\r\n \"value\": \"[[parameters('alertSensitivity')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"alertSensitivity\": {\r\n \"value\": \"[[parameters('alertSensitivity')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#42": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_AG_BackendLastByteResponseTime_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy AGW BackendLastByteResponseTime Alert\",\r\n \"description\": \"Policy to audit/deploy Azure Application Gateway BackendLastByteResponseTime Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.3.0\",\r\n \"category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT1M\"\r\n },\r\n \"alertSensitivity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert Sensitivity\",\r\n \"description\": \"Alert Sensitivity for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"Low\",\r\n \"Medium\",\r\n \"High\"\r\n ],\r\n \"defaultValue\": \"Medium\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/applicationgateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Network/applicationgateways/sku.name\",\r\n \"In\": [\r\n \"Standard_v2\",\r\n \"WAF_v2\"\r\n ]\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/applicationgateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"BackendLastByteResponseTime\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/applicationgateways/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\r\n \"equals\": \"[[parameters('alertSensitivity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": 2\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": 2\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"alertSensitivity\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-agBackendLastByteResponseTime')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for App Gateway BackendLastByteResponseTime\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"BackendLastByteResponseTime\",\r\n \"metricNamespace\": \"Microsoft.Network/applicationgateways\",\r\n \"metricName\": \"BackendLastByteResponseTime\",\r\n \"operator\": \"GreaterThan\",\r\n \"alertSensitivity\": \"[[parameters('alertSensitivity')]\",\r\n \"failingPeriods\": {\r\n \"minFailingPeriodsToAlert\": 2,\r\n \"numberOfEvaluationPeriods\": 2\r\n },\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"DynamicThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"alertSensitivity\": {\r\n \"value\": \"[[parameters('alertSensitivity')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"alertSensitivity\": {\r\n \"value\": \"[[parameters('alertSensitivity')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#43": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_AG_CapacityUnits_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy AGW Capacity Units Alert\",\r\n \"description\": \"Policy to audit/deploy Azure Application Gateway CapacityUnits Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.1\",\r\n \"category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT1M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"75\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/applicationgateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Network/applicationgateways/sku.name\",\r\n \"In\": [\r\n \"Standard_v2\",\r\n \"WAF_v2\"\r\n ]\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/applicationgateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"CapacityUnits\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/applicationgateways/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-agCapacityUnits')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for App Gateway Capacity Units\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"CapacityUnits\",\r\n \"metricNamespace\": \"Microsoft.Network/applicationgateways\",\r\n \"metricName\": \"CapacityUnits\",\r\n \"operator\": \"GreaterThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#44": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_AG_ComputeUnits_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy AGW Compute Units Alert\",\r\n \"description\": \"Policy to audit/deploy Azure Application Gateway ComputeUnits Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.1\",\r\n \"category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT1M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"75\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/applicationgateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Network/applicationgateways/sku.name\",\r\n \"In\": [\r\n \"Standard_v2\",\r\n \"WAF_v2\"\r\n ]\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/applicationgateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"ComputeUnits\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/Microsoft.Network/applicationgateways/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-agComputeUnits')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for App Gateway Compute Units\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"ComputeUnits\",\r\n \"metricNamespace\": \"Microsoft.Network/applicationgateways\",\r\n \"metricName\": \"ComputeUnits\",\r\n \"operator\": \"GreaterThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#45": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_AG_CPUUtilization_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy AGW CPU Utilization Alert\",\r\n \"description\": \"Policy to audit/deploy Azure Application Gateway CPU Utilization Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.1\",\r\n \"category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT1M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"80\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/applicationgateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Network/applicationgateways/sku.name\",\r\n \"notIn\": [\r\n \"Standard_v2\",\r\n \"WAF_v2\"\r\n ]\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/applicationgateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"CpuUtilization\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/applicationgateways/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-agCpuUtilization')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for App Gateway CPU Utilization\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"CpuUtilization\",\r\n \"metricNamespace\": \"Microsoft.Network/applicationgateways\",\r\n \"metricName\": \"CpuUtilization\",\r\n \"operator\": \"GreaterThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#46": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_AG_FailedRequests_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy AGW FailedRequests Alert\",\r\n \"description\": \"Policy to audit/deploy Azure Application Gateway FailedRequests Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.0\",\r\n \"category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT1M\"\r\n },\r\n \"alertSensitivity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert Sensitivity\",\r\n \"description\": \"Alert Sensitivity for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"Low\",\r\n \"Medium\",\r\n \"High\"\r\n ],\r\n \"defaultValue\": \"Medium\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/applicationgateways\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/applicationgateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"FailedRequests\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/applicationgateways/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Total\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\r\n \"equals\": \"[[parameters('alertSensitivity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": 2\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": 2\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"alertSensitivity\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-agFailedRequests')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for App Gateway FailedRequests\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"FailedRequests\",\r\n \"metricNamespace\": \"Microsoft.Network/applicationgateways\",\r\n \"metricName\": \"FailedRequests\",\r\n \"operator\": \"GreaterThan\",\r\n \"alertSensitivity\": \"[[parameters('alertSensitivity')]\",\r\n \"failingPeriods\": {\r\n \"minFailingPeriodsToAlert\": 2,\r\n \"numberOfEvaluationPeriods\": 2\r\n },\r\n \"timeAggregation\": \"Total\",\r\n \"criterionType\": \"DynamicThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"alertSensitivity\": {\r\n \"value\": \"[[parameters('alertSensitivity')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"alertSensitivity\": {\r\n \"value\": \"[[parameters('alertSensitivity')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#47": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_AG_ResponseStatus_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy AGW ResponseStatus Alert\",\r\n \"description\": \"Policy to audit/deploy Azure Application Gateway ResponseStatus Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.0\",\r\n \"category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT1M\"\r\n },\r\n \"alertSensitivity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert Sensitivity\",\r\n \"description\": \"Alert Sensitivity for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"Low\",\r\n \"Medium\",\r\n \"High\"\r\n ],\r\n \"defaultValue\": \"Medium\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/applicationgateways\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/applicationgateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"ResponseStatus\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/applicationgateways/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Total\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\r\n \"equals\": \"[[parameters('alertSensitivity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": 2\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": 2\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"alertSensitivity\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-agResponseStatus')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for App Gateway ResponseStatus\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"ResponseStatus\",\r\n \"metricNamespace\": \"Microsoft.Network/applicationgateways\",\r\n \"metricName\": \"ResponseStatus\",\r\n \"operator\": \"GreaterThan\",\r\n \"alertSensitivity\": \"[[parameters('alertSensitivity')]\",\r\n \"failingPeriods\": {\r\n \"minFailingPeriodsToAlert\": 2,\r\n \"numberOfEvaluationPeriods\": 2\r\n },\r\n \"timeAggregation\": \"Total\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"HttpStatusGroup\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"4xx\",\r\n \"5xx\"\r\n ]\r\n }\r\n ],\r\n \"criterionType\": \"DynamicThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"alertSensitivity\": {\r\n \"value\": \"[[parameters('alertSensitivity')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"alertSensitivity\": {\r\n \"value\": \"[[parameters('alertSensitivity')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#48": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_AG_UnhealthyHostCount_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy AGW Unhealthy Host Count Alert\",\r\n \"description\": \"Policy to audit/deploy Azure Application Gateway Unhealthy Host Count Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.1\",\r\n \"category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT1M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"20\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/applicationgateways\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/applicationgateways\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"UnhealthyHostCount\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/loadBalancers/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-agUnhealthyHostCount')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for App Gateway Unhealthy Host Count\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"CpuUtilization\",\r\n \"metricNamespace\": \"Microsoft.Network/applicationgateways\",\r\n \"metricName\": \"UnhealthyHostCount\",\r\n \"operator\": \"GreaterThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#49": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_WSF_CPUPercentage_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy App Service Plan CPU Percentage Alert\",\r\n \"description\": \"Policy to audit/deploy App Service Plan CPU Percentage Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.1\",\r\n \"category\": \"Web Services\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"90\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Web/serverfarms\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Web/serverfarms\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"CpuPercentage\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Web/serverfarms/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-CpuPercentage')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for App Service Plan CPU Percentage\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"CpuPercentage\",\r\n \"metricNamespace\": \"Microsoft.Web/serverfarms\",\r\n \"metricName\": \"CpuPercentage\",\r\n \"operator\": \"GreaterThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#5": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_AFW_SNATPortUtilization_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy AFW SNATPortUtilization Alert\",\r\n \"description\": \"Policy to audit/deploy Azure Firewall SNATPortUtilization Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.0\",\r\n \"category\": \"Network\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"1\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT1M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"80\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/azureFirewalls\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/azureFirewalls\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"SNATPortUtilization\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/azureFirewalls/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-SNATPortUtilization')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for AFW SNATPortUtilization\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"SNATPortUtilization\",\r\n \"metricNamespace\": \"Microsoft.Network/azureFirewalls\",\r\n \"metricName\": \"SNATPortUtilization\",\r\n \"operator\": \"GreaterThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#50": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_WSF_DiskQueueLength_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy App Service Plan Disk Queue Length Alert\",\r\n \"description\": \"Policy to audit/deploy App Service Plan Disk Queue Length Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.0\",\r\n \"category\": \"Web Services\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Web/serverfarms\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Web/serverfarms\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"DiskQueueLength\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Web/serverfarms/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\r\n \"equals\": \"Medium\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": 2\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": 2\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-DiskQueueLengthAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for App Service Plan Disk Queue Length\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"alertSensitivity\": \"Medium\",\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": 2,\r\n \"minFailingPeriodsToAlert\": 2\r\n },\r\n \"name\": \"ServiceApiResult\",\r\n \"metricNamespace\": \"Microsoft.Web/serverfarms\",\r\n \"metricName\": \"DiskQueueLength\",\r\n \"operator\": \"GreaterThan\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"DynamicThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#51": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_WSF_HttpQueueLength_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy App Service Plan Http Queue Length Alert\",\r\n \"description\": \"Policy to audit/deploy App Service Plan Http Queue Length Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.0\",\r\n \"category\": \"Web Services\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Web/serverfarms\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Web/serverfarms\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"HttpQueueLength\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Web/serverfarms/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\r\n \"equals\": \"Medium\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": 2\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": 2\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-HttpQueueLengthAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for App Service Plan Http Queue Length\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"alertSensitivity\": \"Medium\",\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": 2,\r\n \"minFailingPeriodsToAlert\": 2\r\n },\r\n \"name\": \"ServiceApiResult\",\r\n \"metricNamespace\": \"Microsoft.Web/serverfarms\",\r\n \"metricName\": \"HttpQueueLength\",\r\n \"operator\": \"GreaterThan\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"DynamicThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#52": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_WSF_MemoryPercentage_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy App Service Plan Memory Percentage Alert\",\r\n \"description\": \"Policy to audit/deploy App Service Plan Memory Percentage Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.1\",\r\n \"category\": \"Web Services\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"85\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Web/serverfarms\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Web/serverfarms\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"MemoryPercentage\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Web/serverfarms/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-MemoryPercentage')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for App Service Plan Memory Percentage\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"MemoryPercentage\",\r\n \"metricNamespace\": \"Microsoft.Web/serverfarms\",\r\n \"metricName\": \"MemoryPercentage\",\r\n \"operator\": \"GreaterThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#53": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_FrontDoorCDN_OriginHealthPercentage_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy FrontDoor CDN Profile Origin Health Percentage Alert\",\r\n \"description\": \"Policy to audit/deploy FrontDoor Origin Health Percentage Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.1\",\r\n \"category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"90\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Cdn/profiles\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Cdn/profiles\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"OriginHealthPercentage\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Cdn/profiles/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"LessThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-OriginHealthPercentage')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for Frontdoor Origin Health Percentage\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"OriginHealthPercentage\",\r\n \"metricNamespace\": \"Microsoft.Cdn/profiles\",\r\n \"metricName\": \"OriginHealthPercentage\",\r\n \"operator\": \"LessThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#54": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_FrontDoorCDN_OriginLatency_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy FrontDoor CDN Profile Origin Latency Alert\",\r\n \"description\": \"Policy to audit/deploy FrontDoor CDN Profile Origin Latency Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.1\",\r\n \"category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"disabled\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Cdn/profiles\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Cdn/profiles\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"OriginLatency\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Cdn/profiles/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\r\n \"equals\": \"Medium\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": 2\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": 2\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-OriginLatencyAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for Frontdoor CDN Origin Latency\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"alertSensitivity\": \"Medium\",\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": 2,\r\n \"minFailingPeriodsToAlert\": 2\r\n },\r\n \"name\": \"ServiceApiResult\",\r\n \"metricNamespace\": \"Microsoft.Cdn/profiles\",\r\n \"metricName\": \"OriginLatency\",\r\n \"operator\": \"GreaterThan\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"DynamicThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#55": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_FrontDoorCDN_Percentage4XX_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy FrontDoor CDN Profile Percentage4XX Alert\",\r\n \"description\": \"Policy to audit/deploy FrontDoor CDN Profile Percentage4XX Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.1\",\r\n \"category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Cdn/profiles\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Cdn/profiles\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"Percentage4XX\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Cdn/profiles/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\r\n \"equals\": \"Medium\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": 2\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": 2\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-Percentage4XXAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for Frontdoor CDN Origin Latency\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"alertSensitivity\": \"Medium\",\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": 2,\r\n \"minFailingPeriodsToAlert\": 2\r\n },\r\n \"name\": \"ServiceApiResult\",\r\n \"metricNamespace\": \"Microsoft.Cdn/profiles\",\r\n \"metricName\": \"Percentage4XX\",\r\n \"operator\": \"GreaterThan\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"DynamicThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#56": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_FrontDoorCDN_Percentage5XX_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy FrontDoor CDN Profile Percentage5XX Alert\",\r\n \"description\": \"Policy to audit/deploy FrontDoor CDN Profile Percentage5XX Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.1\",\r\n \"category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Cdn/profiles\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Cdn/profiles\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"Percentage5XX\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Cdn/profiles/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\r\n \"equals\": \"Medium\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": 2\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": 2\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-Percentage5XXAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for Frontdoor CDN Origin Latency\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"alertSensitivity\": \"Medium\",\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": 2,\r\n \"minFailingPeriodsToAlert\": 2\r\n },\r\n \"name\": \"ServiceApiResult\",\r\n \"metricNamespace\": \"Microsoft.Cdn/profiles\",\r\n \"metricName\": \"Percentage5XX\",\r\n \"operator\": \"GreaterThan\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"DynamicThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#57": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VM_AvailableMemory_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VM Available Memory Alert\",\r\n \"description\": \"Policy to audit/deploy VM Available Memory Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.0\",\r\n \"category\": \"Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"1000\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"disabled\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Compute/virtualMachines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Compute/virtualMachines\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"Available Memory Bytes\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Compute/virtualMachines/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].operator\",\r\n \"equals\": \"LessThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-AvailableMemoryAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for Virtual Machine Available Memory (MBytes)\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"Average_AvailableMBytes\",\r\n \"metricNamespace\": \"Microsoft.Compute/virtualMachines\",\r\n \"metricName\": \"Available Memory Bytes\",\r\n \"operator\": \"LessThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#58": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VM_dataDiskReadLatency_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VM Data Disk Read Latency Alert\",\r\n \"description\": \"Policy to audit/deploy VM dataDiskReadLatency Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.0\",\r\n \"category\": \"Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"AlzMonitoring-rg\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"environment\": \"test\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"Equals\",\r\n \"GreaterThan\",\r\n \"GreaterThanOrEqual\",\r\n \"LessThan\",\r\n \"LessThanOrEqual\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Average\",\r\n \"Count\",\r\n \"Maximum\",\r\n \"Minimum\",\r\n \"Total\"\r\n ],\r\n \"defaultValue\": \"Average\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"30\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"disksToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Disks to be included to be monitored\",\r\n \"description\": \"Array of disk to be monitored for disk both windows and linux\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Compute/virtualMachines\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourcegroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-VMHighdataDiskReadLatencyAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"InsightsMetrics| where Origin == \\\"vm.azm.ms\\\"| where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\"| extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"])|where Disk !in ('C:','/')| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"disksToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"VMdataDiskReadLatencyAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-VMHighdataDiskReadLatencyAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-VMHighdataDiskReadLatencyAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine dataDiskReadLatency\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.Compute/virtualMachines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"InsightsMetrics| where Origin == \\\"vm.azm.ms\\\"| where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\"| extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"])|where Disk !in ('C:','/')| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk\",\r\n \"metricMeasureColumn\": \"AggregatedValue\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"Disk\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('disksToInclude')]\"\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"disksToInclude\": {\r\n \"value\": \"[[parameters('disksToInclude')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"disksToInclude\": {\r\n \"value\": \"[[parameters('disksToInclude')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#59": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VM_dataDiskSpace_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VM Data Disk Space Alert\",\r\n \"description\": \"Policy to audit/deploy VM data Disk Space Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.0\",\r\n \"category\": \"Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"AlzMonitoring-rg\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"environment\": \"test\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"Equals\",\r\n \"GreaterThan\",\r\n \"GreaterThanOrEqual\",\r\n \"LessThan\",\r\n \"LessThanOrEqual\"\r\n ],\r\n \"defaultValue\": \"LessThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Average\",\r\n \"Count\",\r\n \"Maximum\",\r\n \"Minimum\",\r\n \"Total\"\r\n ],\r\n \"defaultValue\": \"Average\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"10\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"disksToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Disks to be included to be monitored\",\r\n \"description\": \"Array of disk to be monitored for disk both Windows and Linux\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Compute/virtualMachines\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourcegroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-VMLowdataDiskSpaceAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"InsightsMetrics| where Origin == \\\"vm.azm.ms\\\"| where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\"| extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"])|where Disk !in ('C:','/')| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"disksToInclude\": {\r\n \"type\": \"array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"VMdataDiskSpaceAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-VMLowdataDiskSpaceAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-VMLowdataDiskSpaceAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine dataDiskSpace\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.Compute/virtualMachines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"InsightsMetrics| where Origin == \\\"vm.azm.ms\\\"| where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\"| extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"])|where Disk !in ('C:','/')| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk\",\r\n \"metricMeasureColumn\": \"AggregatedValue\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n },\r\n {\r\n \"name\": \"Disk\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('disksToInclude')]\"\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"disksToInclude\": {\r\n \"value\": \"[[parameters('disksToInclude')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"disksToInclude\": {\r\n \"value\": \"[[parameters('disksToInclude')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#6": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_ERCIR_ArpAvailability_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy ExpressRoute Circuits Arp Availability Alert\",\r\n \"description\": \"Policy to audit/deploy ExpressRoute Circuits Arp Availability Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.0\",\r\n \"category\": \"Network\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"0\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT1M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"90\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/expressRouteCircuits\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/expressRouteCircuits\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"ArpAvailability\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/expressRouteCircuits/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"LessThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-ArpAvailability')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for ExpressRoute Circuit Arp Availability\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"ArpAvailability\",\r\n \"metricNamespace\": \"Microsoft.Network/expressRouteCircuits\",\r\n \"metricName\": \"ArpAvailability\",\r\n \"operator\": \"LessThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#60": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VM_dataDiskWriteLatency_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VM Data Disk Write Latency Alert\",\r\n \"description\": \"Policy to audit/deploy VM dataDiskWriteLatency Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.0\",\r\n \"category\": \"Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"AlzMonitoring-rg\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"environment\": \"test\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"Equals\",\r\n \"GreaterThan\",\r\n \"GreaterThanOrEqual\",\r\n \"LessThan\",\r\n \"LessThanOrEqual\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Average\",\r\n \"Count\",\r\n \"Maximum\",\r\n \"Minimum\",\r\n \"Total\"\r\n ],\r\n \"defaultValue\": \"Average\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"30\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"disksToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Disks to be included to be monitored\",\r\n \"description\": \"Array of disk to be monitored for disk both windows and linux\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Compute/virtualMachines\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourcegroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-VMHighdataDiskWriteLatencyAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"InsightsMetrics| where Origin == \\\"vm.azm.ms\\\"| where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\"| extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"])|where Disk !in ('C:','/')| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"disksToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"VMdataDiskWriteLatencyAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-VMHighdataDiskWriteLatencyAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-VMHighdataDiskWriteLatencyAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine dataDiskWriteLatency\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.Compute/virtualMachines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"InsightsMetrics| where Origin == \\\"vm.azm.ms\\\"| where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\"| extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"])|where Disk !in ('C:','/')| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk\",\r\n \"metricMeasureColumn\": \"AggregatedValue\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"Disk\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('disksToInclude')]\"\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"disksToInclude\": {\r\n \"value\": \"[[parameters('disksToInclude')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"disksToInclude\": {\r\n \"value\": \"[[parameters('disksToInclude')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#61": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VM_HeartBeat_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VM HeartBeat Alert\",\r\n \"description\": \"Policy to audit/deploy VM HeartBeat Alert for all VMs in the subscription\",\r\n \"metadata\": {\r\n \"version\": \"1.2.0\",\r\n \"category\": \"Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"AlzMonitoring-rg\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"environment\": \"test\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"1\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"Equals\",\r\n \"GreaterThan\",\r\n \"GreaterThanOrEqual\",\r\n \"LessThan\",\r\n \"LessThanOrEqual\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Average\",\r\n \"Count\",\r\n \"Maximum\",\r\n \"Minimum\",\r\n \"Total\"\r\n ],\r\n \"defaultValue\": \"Average\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"10\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Compute/virtualMachines\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourcegroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-VMHeartBeatAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"Heartbeat| summarize TimeGenerated=max(TimeGenerated) by Computer, _ResourceId| extend Duration = datetime_diff('minute',now(),TimeGenerated)| summarize AggregatedValue = min(Duration) by Computer, bin(TimeGenerated,5m), _ResourceId\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"HeartBeatAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-VMHeartBeatAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-VMHeartBeatAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine Heartbeat\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.Compute/virtualMachines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"Heartbeat| summarize TimeGenerated=max(TimeGenerated) by Computer, _ResourceId| extend Duration = datetime_diff('minute',now(),TimeGenerated)| summarize AggregatedValue = min(Duration) by Computer, bin(TimeGenerated,5m), _ResourceId\",\r\n \"metricMeasureColumn\": \"AggregatedValue\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#62": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VM_HeartBeat_Alert_RG\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VM HeartBeat Alert\",\r\n \"description\": \"Policy to audit/deploy VM HeartBeat Alert for VMs in the resource group\",\r\n \"metadata\": {\r\n \"version\": \"1.2.0\",\r\n \"category\": \"Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"1\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"Equals\",\r\n \"GreaterThan\",\r\n \"GreaterThanOrEqual\",\r\n \"LessThan\",\r\n \"LessThanOrEqual\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Average\",\r\n \"Count\",\r\n \"Maximum\",\r\n \"Minimum\",\r\n \"Total\"\r\n ],\r\n \"defaultValue\": \"Average\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"10\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Compute/virtualMachines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(resourceGroup().name, '-VMHeartBeatAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name)]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"1\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"1\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"Heartbeat| summarize TimeGenerated=max(TimeGenerated) by Computer, _ResourceId| extend Duration = datetime_diff('minute',now(),TimeGenerated)| summarize AggregatedValue = min(Duration) by Computer, bin(TimeGenerated,5m), _ResourceId\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(resourceGroup().name, '-VMHeartBeatAlert')]\",\r\n \"location\": \"[[resourceGroup().location]\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(resourceGroup().name, '-VMHeartBeatAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine Heartbeat\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[resourceGroup().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.Compute/virtualMachines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"Heartbeat| summarize TimeGenerated=max(TimeGenerated) by Computer, _ResourceId| extend Duration = datetime_diff('minute',now(),TimeGenerated)| summarize AggregatedValue = min(Duration) by Computer, bin(TimeGenerated,5m), _ResourceId\",\r\n \"metricMeasureColumn\": \"AggregatedValue\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": 1,\r\n \"minFailingPeriodsToAlert\": 1\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#63": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VM_NetworkIn_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VM Network Read Alert\",\r\n \"description\": \"Policy to audit/deploy VM Network Read Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.0\",\r\n \"category\": \"Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"AlzMonitoring-rg\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"environment\": \"test\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"Equals\",\r\n \"GreaterThan\",\r\n \"GreaterThanOrEqual\",\r\n \"LessThan\",\r\n \"LessThanOrEqual\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Average\",\r\n \"Count\",\r\n \"Maximum\",\r\n \"Minimum\",\r\n \"Total\"\r\n ],\r\n \"defaultValue\": \"Average\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"10000000\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"networkInterfacesToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Network Interface to be included to be monitored\",\r\n \"description\": \"Array of Network Interface to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Compute/virtualMachines\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourcegroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-VMHighNetworkInAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"InsightsMetrics| where Origin == \\\"vm.azm.ms\\\"| where Namespace == \\\"Network\\\" and Name == \\\"ReadBytesPerSecond\\\"| extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"])|summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"networkInterfacesToInclude\": {\r\n \"type\": \"array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"VMNetworkInAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-VMHighNetworkInAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-VMHighNetworkInAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine NetworkIn\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.Compute/virtualMachines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"InsightsMetrics| where Origin == \\\"vm.azm.ms\\\"| where Namespace == \\\"Network\\\" and Name == \\\"ReadBytesPerSecond\\\"| extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"])|summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface\",\r\n \"metricMeasureColumn\": \"AggregatedValue\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"NetworkInterface\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('networkInterfacesToInclude')]\"\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"networkInterfacesToInclude\": {\r\n \"value\": \"[[parameters('networkInterfacesToInclude')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"networkInterfacesToInclude\": {\r\n \"value\": \"[[parameters('networkInterfacesToInclude')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#64": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VM_NetworkOut_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VM Network Write Alert\",\r\n \"description\": \"Policy to audit/deploy VM Network Out Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.0\",\r\n \"category\": \"Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"AlzMonitoring-rg\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"environment\": \"test\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"Equals\",\r\n \"GreaterThan\",\r\n \"GreaterThanOrEqual\",\r\n \"LessThan\",\r\n \"LessThanOrEqual\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Average\",\r\n \"Count\",\r\n \"Maximum\",\r\n \"Minimum\",\r\n \"Total\"\r\n ],\r\n \"defaultValue\": \"Average\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"10000000\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"networkInterfacesToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Network Interface to be included to be monitored\",\r\n \"description\": \"Array of Network Interface to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Compute/virtualMachines\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourcegroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-VMHighNetworkOutAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"InsightsMetrics| where Origin == \\\"vm.azm.ms\\\"| where Namespace == \\\"Network\\\" and Name == \\\"WriteBytesPerSecond\\\"| extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"])|summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"networkInterfacesToInclude\": {\r\n \"type\": \"array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"VMNetworkOutAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-VMHighNetworkOutAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-VMHighNetworkOutAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine NetworkOut\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.Compute/virtualMachines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"InsightsMetrics| where Origin == \\\"vm.azm.ms\\\"| where Namespace == \\\"Network\\\" and Name == \\\"WriteBytesPerSecond\\\"| extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"])|summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface\",\r\n \"metricMeasureColumn\": \"AggregatedValue\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"NetworkInterface\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('networkInterfacesToInclude')]\"\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"networkInterfacesToInclude\": {\r\n \"value\": \"[[parameters('networkInterfacesToInclude')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"networkInterfacesToInclude\": {\r\n \"value\": \"[[parameters('networkInterfacesToInclude')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#65": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VM_OSDiskreadLatency_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VM OS Disk Read Latency Alert\",\r\n \"description\": \"Policy to audit/deploy VM OSDiskreadLatency Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.0\",\r\n \"category\": \"Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"AlzMonitoring-rg\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"environment\": \"test\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"Equals\",\r\n \"GreaterThan\",\r\n \"GreaterThanOrEqual\",\r\n \"LessThan\",\r\n \"LessThanOrEqual\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Average\",\r\n \"Count\",\r\n \"Maximum\",\r\n \"Minimum\",\r\n \"Total\"\r\n ],\r\n \"defaultValue\": \"Average\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"30\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Disks to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"disksToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Disks to be included to be monitored\",\r\n \"description\": \"Array of disk to be monitored for disk both windows and linux\"\r\n },\r\n \"defaultValue\": [\r\n \"C:\",\r\n \"/\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Compute/virtualMachines\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourcegroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-VMLowOSDiskreadLatencyAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"InsightsMetrics| where Origin == \\\"vm.azm.ms\\\"| where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\"| extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"])| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"disksToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"VMOSDiskreadLatencyAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-VMLowOSDiskreadLatencyAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-VMLowOSDiskreadLatencyAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine OSDiskreadLatency\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.Compute/virtualMachines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"InsightsMetrics| where Origin == \\\"vm.azm.ms\\\"| where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\"| extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"])| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk\",\r\n \"metricMeasureColumn\": \"AggregatedValue\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"Disk\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('disksToInclude')]\"\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"disksToInclude\": {\r\n \"value\": \"[[parameters('disksToInclude')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"disksToInclude\": {\r\n \"value\": \"[[parameters('disksToInclude')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#66": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VM_OSDiskSpace_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VM OS Disk Space Alert\",\r\n \"description\": \"Policy to audit/deploy VM OSDiskSpace Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.0\",\r\n \"category\": \"Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"AlzMonitoring-rg\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"environment\": \"test\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"Equals\",\r\n \"GreaterThan\",\r\n \"GreaterThanOrEqual\",\r\n \"LessThan\",\r\n \"LessThanOrEqual\"\r\n ],\r\n \"defaultValue\": \"LessThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Average\",\r\n \"Count\",\r\n \"Maximum\",\r\n \"Minimum\",\r\n \"Total\"\r\n ],\r\n \"defaultValue\": \"Average\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"10\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Disks to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"disksToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Disks to be included to be monitored\",\r\n \"description\": \"Array of disk to be monitored for disk both windows and linux\"\r\n },\r\n \"defaultValue\": [\r\n \"C:\",\r\n \"/\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Compute/virtualMachines\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourcegroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-VMLowOSDiskSpaceAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"InsightsMetrics| where Origin == \\\"vm.azm.ms\\\"| where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\"| extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"])| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"disksToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"VMOSDiskSpaceAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-VMLowOSDiskSpaceAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-VMLowOSDiskSpaceAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine OSDiskSpace\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.Compute/virtualMachines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"InsightsMetrics| where Origin == \\\"vm.azm.ms\\\"| where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\"| extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"])| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk\",\r\n \"metricMeasureColumn\": \"AggregatedValue\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"Disk\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('disksToInclude')]\"\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"disksToInclude\": {\r\n \"value\": \"[[parameters('disksToInclude')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"disksToInclude\": {\r\n \"value\": \"[[parameters('disksToInclude')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#67": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VM_OSDiskwriteLatency_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VM OS Disk Write Latency Alert\",\r\n \"description\": \"Policy to audit/deploy VM OSDiskwriteLatency Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.0\",\r\n \"category\": \"Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"AlzMonitoring-rg\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"environment\": \"test\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"Equals\",\r\n \"GreaterThan\",\r\n \"GreaterThanOrEqual\",\r\n \"LessThan\",\r\n \"LessThanOrEqual\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Average\",\r\n \"Count\",\r\n \"Maximum\",\r\n \"Minimum\",\r\n \"Total\"\r\n ],\r\n \"defaultValue\": \"Average\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"50\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Disks to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"disksToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Disks to be included to be monitored\",\r\n \"description\": \"Array of disk to be monitored for disk both windows and linux\"\r\n },\r\n \"defaultValue\": [\r\n \"C:\",\r\n \"/\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Compute/virtualMachines\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourcegroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-VMLowOSDiskwriteLatencyAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"InsightsMetrics| where Origin == \\\"vm.azm.ms\\\"| where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\"| extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"])| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"disksToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"VMOSDiskwriteLatencyAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-VMLowOSDiskwriteLatencyAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-VMLowOSDiskwriteLatencyAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine OSDiskwriteLatency\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.Compute/virtualMachines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"InsightsMetrics| where Origin == \\\"vm.azm.ms\\\"| where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\"| extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"])| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk\",\r\n \"metricMeasureColumn\": \"AggregatedValue\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"Disk\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('disksToInclude')]\"\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"disksToInclude\": {\r\n \"value\": \"[[parameters('disksToInclude')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"disksToInclude\": {\r\n \"value\": \"[[parameters('disksToInclude')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#68": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VM_CPU_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VM CPU Alert\",\r\n \"description\": \"Policy to audit/deploy VM CPU Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.0\",\r\n \"category\": \"Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"AlzMonitoring-rg\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"environment\": \"test\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"Equals\",\r\n \"GreaterThan\",\r\n \"GreaterThanOrEqual\",\r\n \"LessThan\",\r\n \"LessThanOrEqual\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Average\",\r\n \"Count\",\r\n \"Maximum\",\r\n \"Minimum\",\r\n \"Total\"\r\n ],\r\n \"defaultValue\": \"Average\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"85\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Compute/virtualMachines\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourcegroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-VMHighCPUAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"1\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"InsightsMetrics| where Origin == \\\"vm.azm.ms\\\"| where Namespace == \\\"Processor\\\" and Name == \\\"UtilizationPercentage\\\"| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"VMCPUAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-VMHighCPUAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-VMHighCPUAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine CPU\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.Compute/virtualMachines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"InsightsMetrics| where Origin == \\\"vm.azm.ms\\\"| where Namespace == \\\"Processor\\\" and Name == \\\"UtilizationPercentage\\\"| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId\",\r\n \"metricMeasureColumn\": \"AggregatedValue\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"1\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#69": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VM_Memory_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VM Memory Alert\",\r\n \"description\": \"Policy to audit/deploy VM Memory Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.0\",\r\n \"category\": \"Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"AlzMonitoring-rg\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"environment\": \"test\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"Equals\",\r\n \"GreaterThan\",\r\n \"GreaterThanOrEqual\",\r\n \"LessThan\",\r\n \"LessThanOrEqual\"\r\n ],\r\n \"defaultValue\": \"LessThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Average\",\r\n \"Count\",\r\n \"Maximum\",\r\n \"Minimum\",\r\n \"Total\"\r\n ],\r\n \"defaultValue\": \"Average\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"10\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Compute/virtualMachines\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourcegroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-VMLowMemoryAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"InsightsMetrics| where Origin == \\\"vm.azm.ms\\\"|where Namespace == \\\"Memory\\\" and Name == \\\"AvailableMB\\\"| extend TotalMemory = toreal(todynamic(Tags)[\\\"vm.azm.ms/memorySizeMB\\\"]) | extend AvailableMemoryPercentage = (toreal(Val) / TotalMemory) * 100.0| summarize AggregatedValue = avg(AvailableMemoryPercentage) by bin(TimeGenerated, 15m), Computer, _ResourceId\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"VMMemoryAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-VMLowMemoryAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-VMLowMemoryAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine Memory\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.Compute/virtualMachines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"InsightsMetrics| where Origin == \\\"vm.azm.ms\\\"|where Namespace == \\\"Memory\\\" and Name == \\\"AvailableMB\\\"| extend TotalMemory = toreal(todynamic(Tags)[\\\"vm.azm.ms/memorySizeMB\\\"]) | extend AvailableMemoryPercentage = (toreal(Val) / TotalMemory) * 100.0| summarize AggregatedValue = avg(AvailableMemoryPercentage) by bin(TimeGenerated, 15m), Computer, _ResourceId\",\r\n \"metricMeasureColumn\": \"AggregatedValue\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#7": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_ERCIR_BgpAvailability_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy ExpressRoute Circuits Bgp Availability Alert\",\r\n \"description\": \"Policy to audit/deploy ExpressRoute Circuits Bgp Availability Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.0\",\r\n \"category\": \"Network\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"0\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT1M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"90\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/expressRouteCircuits\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/expressRouteCircuits\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"BgpAvailability\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/expressRouteCircuits/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"LessThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-BgpAvailability')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for ExpressRoute Circuit Bgp Availability\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"BgpAvailability\",\r\n \"metricNamespace\": \"Microsoft.Network/expressRouteCircuits\",\r\n \"metricName\": \"BgpAvailability\",\r\n \"operator\": \"LessThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#70": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_TM_EndpointHealth_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Traffic Manager Endpoint Health Alert\",\r\n \"description\": \"Policy to audit/deploy FTraffic Manager Endpoint Health Health Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.1\",\r\n \"category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"0.9\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/trafficmanagerprofiles\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/trafficmanagerprofiles\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"ProbeAgentCurrentEndpointStateByProfileResourceId\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/trafficmanagerprofiles/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"LessThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-EndpointHealthAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for Traffic Manager Endpoint Health\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"EndpointHealth\",\r\n \"metricNamespace\": \"Microsoft.Network/trafficmanagerprofiles\",\r\n \"metricName\": \"ProbeAgentCurrentEndpointStateByProfileResourceId\",\r\n \"operator\": \"LessThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"EndpointName\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ]\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#71": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_FD_BackendHealth_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Frontdoor Backend Health Percentage Alert\",\r\n \"description\": \"Policy to audit/deploy FrontDoor Backend Health Percentage Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.1\",\r\n \"category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"90\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"disabled\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/frontdoors\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/frontdoors\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"BackendHealthPercentage\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/frontdoors/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"LessThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-BackendHealthPercentage')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for Frontdoor Backend Health Percentage\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"BackendHealthPercentage\",\r\n \"metricNamespace\": \"Microsoft.Network/frontdoors\",\r\n \"metricName\": \"BackendHealthPercentage\",\r\n \"operator\": \"LessThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#72": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_FD_BackendRequestLatency_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Frontdoor Backend Request Latency Alert\",\r\n \"description\": \"Policy to audit/deploy Frontdoor Backend Request Latency Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.0\",\r\n \"category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"disabled\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/frontdoors\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/frontdoors\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"BackendRequestLatency\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/frontdoors/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\r\n \"equals\": \"Medium\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": 2\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": 2\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-BackendRequestLatencyAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for Frontdoor BackendRequestLatency\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"alertSensitivity\": \"Medium\",\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": 2,\r\n \"minFailingPeriodsToAlert\": 2\r\n },\r\n \"name\": \"ServiceApiResult\",\r\n \"metricNamespace\": \"Microsoft.Network/frontdoors\",\r\n \"metricName\": \"BackendRequestLatency\",\r\n \"operator\": \"GreaterThan\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"DynamicThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#73": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_KeyVault_Availability_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy KeyVault Availability Alert\",\r\n \"description\": \"Policy to audit/deploy KeyVault Availability Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.0\",\r\n \"category\": \"Key Vault\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"1\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT1M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"90\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"disabled\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"microsoft.keyvault/vaults\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"microsoft.keyvault/vaults\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"Availability\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/microsoft.keyvault/vaults/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"LessThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-Availability')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for KeyVault Availability\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"Availability\",\r\n \"metricNamespace\": \"microsoft.keyvault/vaults\",\r\n \"metricName\": \"Availability\",\r\n \"operator\": \"LessThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#74": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_KeyVault_Capacity_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy KeyVault Capacity Alert\",\r\n \"description\": \"Policy to audit/deploy KeyVault Capacity Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.0\",\r\n \"category\": \"Key Vault\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"1\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT1M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"75\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"disabled\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"microsoft.keyvault/vaults\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"microsoft.keyvault/vaults\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"SaturationShoebox\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/microsoft.keyvault/vaults/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-CapacityAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for KeyVault Capacity\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"SaturationShoebox\",\r\n \"metricNamespace\": \"microsoft.keyvault/vaults\",\r\n \"metricName\": \"SaturationShoebox\",\r\n \"operator\": \"GreaterThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#75": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_KeyVault_Latency_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy KeyVault Latency Alert\",\r\n \"description\": \"Policy to audit/deploy KeyVault Latency Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.0\",\r\n \"category\": \"Key Vault\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"3\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"1000\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"disabled\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"microsoft.keyvault/vaults\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"microsoft.keyvault/vaults\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"ServiceApiLatency\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/microsoft.keyvault/vaults/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-LatencyAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for KeyVault Latency\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"ServiceApiLatency\",\r\n \"metricNamespace\": \"microsoft.keyvault/vaults\",\r\n \"metricName\": \"ServiceApiLatency\",\r\n \"operator\": \"GreaterThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#76": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_KeyVault_Requests_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy KeyVault Requests Alert\",\r\n \"description\": \"Policy to audit/deploy KeyVault Requests Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.2.0\",\r\n \"category\": \"Key Vault\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"disabled\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Monitoring disabled\",\r\n \"description\": \"Tag name to disable monitoring. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"microsoft.keyvault/vaults\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"microsoft.keyvault/vaults\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"ServiceApiResult\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/microsoft.keyvault/vaults/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\r\n \"equals\": \"Medium\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": 4\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": 4\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-RequestsAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for KeyVault Requests\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"alertSensitivity\": \"Medium\",\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": 4,\r\n \"minFailingPeriodsToAlert\": 4\r\n },\r\n \"name\": \"ServiceApiResult\",\r\n \"metricNamespace\": \"microsoft.keyvault/vaults\",\r\n \"metricName\": \"ServiceApiResult\",\r\n \"operator\": \"GreaterThan\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"DynamicThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#77": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_activitylog_KeyVault_Delete\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Activity Log Key Vault Delete Alert\",\r\n \"description\": \"Policy to Deploy Activity Log Key Vault Delete Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.0.1\",\r\n \"category\": \"Key Vault\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"AlzMonitoring-rg\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"environment\": \"test\",\r\n \"_deployed_by_amba\": true\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring on resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"microsoft.keyvault/vaults\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"deployIfNotExists\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/activityLogAlerts\",\r\n \"name\": \"ActivityKeyVaultDelete\",\r\n \"existenceScope\": \"resourcegroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"count\": {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*]\",\r\n \"where\": {\r\n \"anyOf\": [\r\n {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].field\",\r\n \"equals\": \"category\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].equals\",\r\n \"equals\": \"Administrative\"\r\n }\r\n ]\r\n },\r\n {\r\n \"allOf\": [\r\n {\r\n \"field\": \"microsoft.insights/activityLogAlerts/condition.allOf[*].field\",\r\n \"equals\": \"operationName\"\r\n },\r\n {\r\n \"field\": \"microsoft.insights/activityLogAlerts/condition.allOf[*].equals\",\r\n \"equals\": \"Microsoft.KeyVault/vaults/delete\"\r\n }\r\n ]\r\n }\r\n ]\r\n }\r\n },\r\n \"equals\": 2\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"ActivityKeyVaultDelete\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"microsoft.insights/activityLogAlerts\",\r\n \"apiVersion\": \"2020-10-01\",\r\n \"name\": \"ActivityKeyVaultDelete\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Activity Log Key Vault Delete\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().id]\"\r\n ],\r\n \"condition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"category\",\r\n \"equals\": \"Administrative\"\r\n },\r\n {\r\n \"field\": \"operationName\",\r\n \"equals\": \"Microsoft.KeyVault/vaults/delete\"\r\n },\r\n {\r\n \"field\": \"status\",\r\n \"containsAny\": [\r\n \"succeeded\"\r\n ]\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#78": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_ALB_DataPathAvailability_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy ALB Data Path Availability Alert\",\r\n \"description\": \"Policy to audit/deploy Azure Load Balancer Data Path Availability Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.1\",\r\n \"category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"0\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT1M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"90\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/loadBalancers\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Network/loadBalancers/sku.name\",\r\n \"in\": [\r\n \"Standard\",\r\n \"Gateway\"\r\n ]\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/loadBalancers\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"VipAvailability\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/loadBalancers/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"LessThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-ALBDataPathAvailability')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for ALB Data Path Availability\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"VipAvailability\",\r\n \"metricNamespace\": \"Microsoft.Network/loadBalancers\",\r\n \"metricName\": \"VipAvailability\",\r\n \"operator\": \"LessThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#79": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_ALB_GlobalBackendAvailability_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy ALB Global Backend Availability Alert\",\r\n \"description\": \"Policy to audit/deploy Azure Load Balancer Global Backend Availability Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.1\",\r\n \"category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"0\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT1M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"90\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/loadBalancers\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Network/loadBalancers/sku.tier\",\r\n \"equals\": \"Global\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/loadBalancers\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"GlobalBackendAvailability\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/loadBalancers/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"LessThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-ALBGlobalBackendAvailability')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for Global Backend Availability\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"GlobalBackendAvailability\",\r\n \"metricNamespace\": \"Microsoft.Network/loadBalancers\",\r\n \"metricName\": \"GlobalBackendAvailability\",\r\n \"operator\": \"LessThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#8": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_ERCIR_QosDropBitsInPerSecond_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy ExpressRoute Circuits QosDropBitsInPerSecond Alert\",\r\n \"description\": \"Policy to audit/deploy ExpressRoute Circuits QosDropBitsInPerSecond Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.0\",\r\n \"category\": \"Network\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/expressRouteCircuits\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/expressRouteCircuits\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"QosDropBitsInPerSecond\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/expressRouteCircuits/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\r\n \"equals\": \"Medium\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": 2\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": 2\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-QosDropBitsInPerSecond')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for ExpressRoute Circuit QosDropBitsInPerSecond\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"alertSensitivity\": \"Medium\",\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": 4,\r\n \"minFailingPeriodsToAlert\": 4\r\n },\r\n \"name\": \"QosDropBitsInPerSecond\",\r\n \"metricNamespace\": \"Microsoft.Network/expressRouteCircuits\",\r\n \"metricName\": \"QosDropBitsInPerSecond\",\r\n \"operator\": \"GreaterThan\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"DynamicThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#80": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_ALB_HealthProbeStatus_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy ALB Health Probe Status Alert\",\r\n \"description\": \"Policy to audit/deploy Azure Load Balancer Health Probe Status Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.1\",\r\n \"category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT1M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"90\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/loadBalancers\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Network/loadBalancers/sku.name\",\r\n \"in\": [\r\n \"Standard\",\r\n \"Gateway\"\r\n ]\r\n },\r\n {\r\n \"field\": \"Microsoft.Network/loadBalancers/sku.tier\",\r\n \"equals\": \"Regional\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/loadBalancers\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"DipAvailability\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/loadBalancers/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"LessThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-ALBHealthProbeStatus')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for ALB Health Probe Status\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"DipAvailability\",\r\n \"metricNamespace\": \"Microsoft.Network/loadBalancers\",\r\n \"metricName\": \"DipAvailability\",\r\n \"operator\": \"LessThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#81": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_ALB_UsedSNATPorts_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy ALB Used SNAT Ports Alert\",\r\n \"description\": \"Policy to audit/deploy Azure Load Balancer Used SNAT Ports Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.1\",\r\n \"category\": \"Networking\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"1\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT1M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"900\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/loadBalancers\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/loadBalancers\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"UsedSNATPorts\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/loadBalancers/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-ALBUsedSNATPorts')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for ALB Used SNAT Ports\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"UsedSNATPorts\",\r\n \"metricNamespace\": \"Microsoft.Network/loadBalancers\",\r\n \"metricName\": \"UsedSNATPorts\",\r\n \"operator\": \"GreaterThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#82": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_PublicIp_BytesInDDoSAttack_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy PIP Bytes in DDoS Attack Alert\",\r\n \"description\": \"Policy to audit/deploy PIP Bytes in DDoS Attack Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.0\",\r\n \"category\": \"Network\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"4\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"8000000\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"disabled\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/publicIPAddresses\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/publicIPAddresses\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"bytesinddos\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/publicIPAddresses/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Maximum\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-BytesInDDOSAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for Public IP Address Bytes IN DDOS\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"bytesinddos\",\r\n \"metricNamespace\": \"Microsoft.Network/publicIPAddresses\",\r\n \"metricName\": \"bytesinddos\",\r\n \"operator\": \"GreaterThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Maximum\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#83": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_PublicIp_DDoSAttack_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy PIP DDoS Attack Alert\",\r\n \"description\": \"Policy to audit/deploy PIP DDoS Attack Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.0\",\r\n \"category\": \"Network\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"1\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"0\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/publicIPAddresses\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/publicIPAddresses\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"ifunderddosattack\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/publicIPAddresses/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Maximum\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-DDOS_Attack')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for Public IP Address Under Attack\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"ifunderddosattack\",\r\n \"metricNamespace\": \"Microsoft.Network/publicIPAddresses\",\r\n \"metricName\": \"ifunderddosattack\",\r\n \"operator\": \"GreaterThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Maximum\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#84": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_PublicIp_PacketsInDDoSAttack_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy PIP Packets in DDoS Attack Alert\",\r\n \"description\": \"Policy to audit/deploy PIP Packets in DDoS Attack Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.0\",\r\n \"category\": \"Network\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"4\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"40000\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"disabled\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/publicIPAddresses\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/publicIPAddresses\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"PacketsInDDoS\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/publicIPAddresses/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Total\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].operator\",\r\n \"equals\": \"GreaterThanOrEqual\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-PacketsInDDosAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for Public IP Address Packets IN DDOS\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"PacketsInDDoS\",\r\n \"metricNamespace\": \"Microsoft.Network/publicIPAddresses\",\r\n \"metricName\": \"PacketsInDDoS\",\r\n \"operator\": \"GreaterThanOrEqual\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Total\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#85": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_PublicIp_VIPAvailability_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy PIP VIP Availability Alert\",\r\n \"description\": \"Policy to audit/deploy PIP VIP Availability Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.0\",\r\n \"category\": \"Network\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"1\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT1M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"90\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/publicIPAddresses\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Network/publicIPAddresses/sku.name\",\r\n \"equals\": \"Standard\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/publicIPAddresses\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"VipAvailability\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/publicIPAddresses/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"LessThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-VIPAvailabityAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for Public IP Address VIP Availability\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"VipAvailability\",\r\n \"metricNamespace\": \"Microsoft.Network/publicIPAddresses\",\r\n \"metricName\": \"VipAvailability\",\r\n \"operator\": \"LessThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#86": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_VNET_DDoSAttack_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy VNet DDoS Attack Alert\",\r\n \"description\": \"Policy to audit/deploy Virtual Network DDoS Attack Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.0\",\r\n \"category\": \"Network\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"1\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT1M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"0\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/virtualNetworks\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/virtualNetworks\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"ifunderddosattack\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/virtualNetworks/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Maximum\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-DDOSAttackAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for VNet DDOS Attack\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"ifunderddosattack\",\r\n \"metricNamespace\": \"Microsoft.Network/virtualNetworks\",\r\n \"metricName\": \"ifunderddosattack\",\r\n \"operator\": \"GreaterThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Maximum\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#87": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_AvailableMemory_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM Available Memory Alert\",\r\n \"description\": \"Policy to audit/deploy VM Available Memory Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.0.0\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"1000\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"disabled\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"Available Memory Bytes\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Compute/virtualMachines/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].operator\",\r\n \"equals\": \"LessThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-AvailableMemoryAlert')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for Virtual Machine Available Memory (MBytes)\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"name\": \"Average_AvailableMBytes\",\r\n \"metricNamespace\": \"Microsoft.HybridCompute/machines\",\r\n \"metricName\": \"Available Memory Bytes\",\r\n \"operator\": \"LessThan\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"StaticThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#88": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_dataDiskReadLatency_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM Data Disk Read Latency Alert\",\r\n \"description\": \"Policy to audit/deploy VM dataDiskReadLatency Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.0.1\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"AlzMonitoring-rg\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"environment\": \"test\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"Equals\",\r\n \"GreaterThan\",\r\n \"GreaterThanOrEqual\",\r\n \"LessThan\",\r\n \"LessThanOrEqual\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Average\",\r\n \"Count\",\r\n \"Maximum\",\r\n \"Minimum\",\r\n \"Total\"\r\n ],\r\n \"defaultValue\": \"Average\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"30\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"disksToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Disks to be included to be monitored\",\r\n \"description\": \"Array of disk to be monitored for disk both windows and linux\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourcegroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighdataDiskReadLatencyAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"InsightsMetrics| where Origin == \\\"vm.azm.ms\\\"| where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\"| extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"])|where Disk !in ('C:','/')| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"disksToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"VMdataDiskReadLatencyAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighdataDiskReadLatencyAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighdataDiskReadLatencyAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine dataDiskReadLatency\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.HybridCompute/machines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"InsightsMetrics| where Origin == \\\"vm.azm.ms\\\"| where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\"| extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"])|where Disk !in ('C:','/')| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk\",\r\n \"metricMeasureColumn\": \"AggregatedValue\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"Disk\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('disksToInclude')]\"\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"disksToInclude\": {\r\n \"value\": \"[[parameters('disksToInclude')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"disksToInclude\": {\r\n \"value\": \"[[parameters('disksToInclude')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#89": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_dataDiskSpace_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM Data Disk Space Alert\",\r\n \"description\": \"Policy to audit/deploy VM data Disk Space Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.0.1\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"AlzMonitoring-rg\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"environment\": \"test\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"Equals\",\r\n \"GreaterThan\",\r\n \"GreaterThanOrEqual\",\r\n \"LessThan\",\r\n \"LessThanOrEqual\"\r\n ],\r\n \"defaultValue\": \"LessThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Average\",\r\n \"Count\",\r\n \"Maximum\",\r\n \"Minimum\",\r\n \"Total\"\r\n ],\r\n \"defaultValue\": \"Average\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"10\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"disksToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Disks to be included to be monitored\",\r\n \"description\": \"Array of disk to be monitored for disk both Windows and Linux\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourcegroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMLowdataDiskSpaceAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"InsightsMetrics| where Origin == \\\"vm.azm.ms\\\"| where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\"| extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"])|where Disk !in ('C:','/')| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"disksToInclude\": {\r\n \"type\": \"array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"VMdataDiskSpaceAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-HybridVMLowdataDiskSpaceAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMLowdataDiskSpaceAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine dataDiskSpace\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.HybridCompute/machines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"InsightsMetrics| where Origin == \\\"vm.azm.ms\\\"| where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\"| extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"])|where Disk !in ('C:','/')| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk\",\r\n \"metricMeasureColumn\": \"AggregatedValue\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n },\r\n {\r\n \"name\": \"Disk\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('disksToInclude')]\"\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"disksToInclude\": {\r\n \"value\": \"[[parameters('disksToInclude')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"disksToInclude\": {\r\n \"value\": \"[[parameters('disksToInclude')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#9": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_ERCIR_QosDropBitsOutPerSecond_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy ExpressRoute Circuits QosDropBitsOutPerSecond Alert\",\r\n \"description\": \"Policy to audit/deploy ExpressRoute Circuits QosDropBitsOutPerSecond Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.1.0\",\r\n \"category\": \"Network\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"P1D\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT1M\",\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.Network/expressRouteCircuits\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace\",\r\n \"equals\": \"Microsoft.Network/expressRouteCircuits\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName\",\r\n \"equals\": \"QosDropBitsOutPerSecond\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/expressRouteCircuits/', field('fullName'))]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricalerts/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].timeAggregation\",\r\n \"equals\": \"Average\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.operator\",\r\n \"equals\": \"GreaterThan\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.alertSensitivity\",\r\n \"equals\": \"Medium\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": 2\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-MultipleResourceMultipleMetricCriteria.allOf[*].DynamicThresholdCriterion.failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": 2\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceName\",\r\n \"description\": \"Name of the resource\"\r\n }\r\n },\r\n \"resourceId\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"resourceId\",\r\n \"description\": \"Resource ID of the resource emitting the metric that will be used for the comparison\"\r\n }\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/metricAlerts\",\r\n \"apiVersion\": \"2018-03-01\",\r\n \"name\": \"[[concat(parameters('resourceName'), '-QosDropBitsOutPerSecond')]\",\r\n \"location\": \"global\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"description\": \"Metric Alert for ExpressRoute Circuit QosDropBitsOutPerSecond\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[parameters('resourceId')]\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"alertSensitivity\": \"Medium\",\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": 4,\r\n \"minFailingPeriodsToAlert\": 4\r\n },\r\n \"name\": \"QosDropBitsOutPerSecond\",\r\n \"metricNamespace\": \"Microsoft.Network/expressRouteCircuits\",\r\n \"metricName\": \"QosDropBitsOutPerSecond\",\r\n \"operator\": \"GreaterThan\",\r\n \"timeAggregation\": \"Average\",\r\n \"criterionType\": \"DynamicThresholdCriterion\"\r\n }\r\n ],\r\n \"odata.type\": \"Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria\"\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"resourceName\": {\r\n \"value\": \"[[field('name')]\"\r\n },\r\n \"resourceId\": {\r\n \"value\": \"[[field('id')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#90": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_dataDiskWriteLatency_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM Data Disk Write Latency Alert\",\r\n \"description\": \"Policy to audit/deploy VM dataDiskWriteLatency Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.0.1\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"AlzMonitoring-rg\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"environment\": \"test\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"Equals\",\r\n \"GreaterThan\",\r\n \"GreaterThanOrEqual\",\r\n \"LessThan\",\r\n \"LessThanOrEqual\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Average\",\r\n \"Count\",\r\n \"Maximum\",\r\n \"Minimum\",\r\n \"Total\"\r\n ],\r\n \"defaultValue\": \"Average\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"30\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"disksToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Disks to be included to be monitored\",\r\n \"description\": \"Array of disk to be monitored for disk both windows and linux\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourcegroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighdataDiskWriteLatencyAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"InsightsMetrics| where Origin == \\\"vm.azm.ms\\\"| where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\"| extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"])|where Disk !in ('C:','/')| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"disksToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"VMdataDiskWriteLatencyAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighdataDiskWriteLatencyAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighdataDiskWriteLatencyAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine dataDiskWriteLatency\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.HybridCompute/machines\",\r\n \"Microsoft.HybridCompute/machines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"InsightsMetrics| where Origin == \\\"vm.azm.ms\\\"| where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\"| extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"])|where Disk !in ('C:','/')| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk\",\r\n \"metricMeasureColumn\": \"AggregatedValue\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"Disk\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('disksToInclude')]\"\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"disksToInclude\": {\r\n \"value\": \"[[parameters('disksToInclude')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"disksToInclude\": {\r\n \"value\": \"[[parameters('disksToInclude')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#91": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_HeartBeat_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM HeartBeat Alert\",\r\n \"description\": \"Policy to audit/deploy VM HeartBeat Alert for all VMs in the subscription\",\r\n \"metadata\": {\r\n \"version\": \"1.0.1\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"AlzMonitoring-rg\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"environment\": \"test\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"1\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"Equals\",\r\n \"GreaterThan\",\r\n \"GreaterThanOrEqual\",\r\n \"LessThan\",\r\n \"LessThanOrEqual\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Average\",\r\n \"Count\",\r\n \"Maximum\",\r\n \"Minimum\",\r\n \"Total\"\r\n ],\r\n \"defaultValue\": \"Average\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"10\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourcegroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHeartBeatAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"Heartbeat| summarize TimeGenerated=max(TimeGenerated) by Computer, _ResourceId| extend Duration = datetime_diff('minute',now(),TimeGenerated)| summarize AggregatedValue = min(Duration) by Computer, bin(TimeGenerated,5m), _ResourceId\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"HeartBeatAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHeartBeatAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHeartBeatAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine Heartbeat\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.HybridCompute/machines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"Heartbeat| summarize TimeGenerated=max(TimeGenerated) by Computer, _ResourceId| extend Duration = datetime_diff('minute',now(),TimeGenerated)| summarize AggregatedValue = min(Duration) by Computer, bin(TimeGenerated,5m), _ResourceId\",\r\n \"metricMeasureColumn\": \"AggregatedValue\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#92": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_HeartBeat_Alert_RG\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM HeartBeat Alert\",\r\n \"description\": \"Policy to audit/deploy VM HeartBeat Alert for VMs in the resource group\",\r\n \"metadata\": {\r\n \"version\": \"1.0.1\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"1\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"Equals\",\r\n \"GreaterThan\",\r\n \"GreaterThanOrEqual\",\r\n \"LessThan\",\r\n \"LessThanOrEqual\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Average\",\r\n \"Count\",\r\n \"Maximum\",\r\n \"Minimum\",\r\n \"Total\"\r\n ],\r\n \"defaultValue\": \"Average\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"10\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n },\r\n \"MonitorDisable\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Tag name to disable monitoring resource. Set to true if monitoring should be disabled\"\r\n },\r\n \"defaultValue\": \"MonitorDisable\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n },\r\n {\r\n \"field\": \"[[concat('tags[', parameters('MonitorDisable'), ']')]\",\r\n \"notEquals\": \"true\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(resourceGroup().name, '-HybridVMHeartBeatAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/scopes[*]\",\r\n \"equals\": \"[[concat(subscription().id, '/resourceGroups/', resourceGroup().name)]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"1\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"1\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"Heartbeat| summarize TimeGenerated=max(TimeGenerated) by Computer, _ResourceId| extend Duration = datetime_diff('minute',now(),TimeGenerated)| summarize AggregatedValue = min(Duration) by Computer, bin(TimeGenerated,5m), _ResourceId\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(resourceGroup().name, '-HybridVMHeartBeatAlert')]\",\r\n \"location\": \"[[resourceGroup().location]\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(resourceGroup().name, '-HybridVMHeartBeatAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine Heartbeat\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[resourceGroup().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.HybridCompute/machines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"Heartbeat| summarize TimeGenerated=max(TimeGenerated) by Computer, _ResourceId| extend Duration = datetime_diff('minute',now(),TimeGenerated)| summarize AggregatedValue = min(Duration) by Computer, bin(TimeGenerated,5m), _ResourceId\",\r\n \"metricMeasureColumn\": \"AggregatedValue\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": 1,\r\n \"minFailingPeriodsToAlert\": 1\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#93": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_NetworkIn_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM Network Read Alert\",\r\n \"description\": \"Policy to audit/deploy VM Nework Read Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.0.1\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"AlzMonitoring-rg\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"environment\": \"test\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"Equals\",\r\n \"GreaterThan\",\r\n \"GreaterThanOrEqual\",\r\n \"LessThan\",\r\n \"LessThanOrEqual\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Average\",\r\n \"Count\",\r\n \"Maximum\",\r\n \"Minimum\",\r\n \"Total\"\r\n ],\r\n \"defaultValue\": \"Average\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"10000000\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"networkInterfacesToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Network Interface to be included to be monitored\",\r\n \"description\": \"Array of Network Interface to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourcegroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighNetworkInAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"InsightsMetrics| where Origin == \\\"vm.azm.ms\\\"| where Namespace == \\\"Network\\\" and Name == \\\"ReadBytesPerSecond\\\"| extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"])|summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"networkInterfacesToInclude\": {\r\n \"type\": \"array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"VMNetworkInAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighNetworkInAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighNetworkInAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine NetworkIn\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.HybridCompute/machines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"InsightsMetrics| where Origin == \\\"vm.azm.ms\\\"| where Namespace == \\\"Network\\\" and Name == \\\"ReadBytesPerSecond\\\"| extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"])|summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface\",\r\n \"metricMeasureColumn\": \"AggregatedValue\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"NetworkInterface\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('networkInterfacesToInclude')]\"\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"networkInterfacesToInclude\": {\r\n \"value\": \"[[parameters('networkInterfacesToInclude')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"networkInterfacesToInclude\": {\r\n \"value\": \"[[parameters('networkInterfacesToInclude')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#94": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_NetworkOut_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM Network Write Alert\",\r\n \"description\": \"Policy to audit/deploy VM Network Out Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.0.1\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"AlzMonitoring-rg\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"environment\": \"test\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"Equals\",\r\n \"GreaterThan\",\r\n \"GreaterThanOrEqual\",\r\n \"LessThan\",\r\n \"LessThanOrEqual\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Average\",\r\n \"Count\",\r\n \"Maximum\",\r\n \"Minimum\",\r\n \"Total\"\r\n ],\r\n \"defaultValue\": \"Average\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"10000000\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Computers to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"networkInterfacesToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Network Interface to be included to be monitored\",\r\n \"description\": \"Array of Network Interface to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourcegroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighNetworkOutAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"InsightsMetrics| where Origin == \\\"vm.azm.ms\\\"| where Namespace == \\\"Network\\\" and Name == \\\"WriteBytesPerSecond\\\"| extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"])|summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"networkInterfacesToInclude\": {\r\n \"type\": \"array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"VMNetworkOutAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighNetworkOutAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighNetworkOutAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine NetworkOut\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.HybridCompute/machines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"InsightsMetrics| where Origin == \\\"vm.azm.ms\\\"| where Namespace == \\\"Network\\\" and Name == \\\"WriteBytesPerSecond\\\"| extend NetworkInterface=tostring(todynamic(Tags)[\\\"vm.azm.ms/networkDeviceId\\\"])|summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface\",\r\n \"metricMeasureColumn\": \"AggregatedValue\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"NetworkInterface\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('networkInterfacesToInclude')]\"\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"networkInterfacesToInclude\": {\r\n \"value\": \"[[parameters('networkInterfacesToInclude')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n },\r\n \"networkInterfacesToInclude\": {\r\n \"value\": \"[[parameters('networkInterfacesToInclude')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#95": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_OSDiskreadLatency_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM OS Disk Read Latency Alert\",\r\n \"description\": \"Policy to audit/deploy VM OSDiskreadLatency Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.0.1\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"AlzMonitoring-rg\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"environment\": \"test\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"Equals\",\r\n \"GreaterThan\",\r\n \"GreaterThanOrEqual\",\r\n \"LessThan\",\r\n \"LessThanOrEqual\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Average\",\r\n \"Count\",\r\n \"Maximum\",\r\n \"Minimum\",\r\n \"Total\"\r\n ],\r\n \"defaultValue\": \"Average\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"30\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Disks to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"disksToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Disks to be included to be monitored\",\r\n \"description\": \"Array of disk to be monitored for disk both windows and linux\"\r\n },\r\n \"defaultValue\": [\r\n \"C:\",\r\n \"/\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourcegroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMLowOSDiskreadLatencyAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"InsightsMetrics| where Origin == \\\"vm.azm.ms\\\"| where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\"| extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"])| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"disksToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"VMOSDiskreadLatencyAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-HybridVMLowOSDiskreadLatencyAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMLowOSDiskreadLatencyAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine OSDiskreadLatency\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.HybridCompute/machines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"InsightsMetrics| where Origin == \\\"vm.azm.ms\\\"| where Namespace == \\\"LogicalDisk\\\" and Name == \\\"ReadLatencyMs\\\"| extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"])| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk\",\r\n \"metricMeasureColumn\": \"AggregatedValue\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"Disk\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('disksToInclude')]\"\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"disksToInclude\": {\r\n \"value\": \"[[parameters('disksToInclude')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"disksToInclude\": {\r\n \"value\": \"[[parameters('disksToInclude')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#96": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_OSDiskSpace_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM OS Disk Space Alert\",\r\n \"description\": \"Policy to audit/deploy VM OSDiskSpace Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.0.1\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"AlzMonitoring-rg\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"environment\": \"test\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"Equals\",\r\n \"GreaterThan\",\r\n \"GreaterThanOrEqual\",\r\n \"LessThan\",\r\n \"LessThanOrEqual\"\r\n ],\r\n \"defaultValue\": \"LessThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Average\",\r\n \"Count\",\r\n \"Maximum\",\r\n \"Minimum\",\r\n \"Total\"\r\n ],\r\n \"defaultValue\": \"Average\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"10\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Disks to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"disksToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Disks to be included to be monitored\",\r\n \"description\": \"Array of disk to be monitored for disk both windows and linux\"\r\n },\r\n \"defaultValue\": [\r\n \"C:\",\r\n \"/\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourcegroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMLowOSDiskSpaceAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"InsightsMetrics| where Origin == \\\"vm.azm.ms\\\"| where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\"| extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"])| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"disksToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"VMOSDiskSpaceAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-HybridVMLowOSDiskSpaceAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMLowOSDiskSpaceAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine OSDiskSpace\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.HybridCompute/machines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"InsightsMetrics| where Origin == \\\"vm.azm.ms\\\"| where Namespace == \\\"LogicalDisk\\\" and Name == \\\"FreeSpacePercentage\\\"| extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"])| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk\",\r\n \"metricMeasureColumn\": \"AggregatedValue\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"Disk\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('disksToInclude')]\"\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"disksToInclude\": {\r\n \"value\": \"[[parameters('disksToInclude')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"disksToInclude\": {\r\n \"value\": \"[[parameters('disksToInclude')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#97": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_OSDiskwriteLatency_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM OS Disk Write Latency Alert\",\r\n \"description\": \"Policy to audit/deploy VM OSDiskwriteLatency Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.0.1\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"AlzMonitoring-rg\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"environment\": \"test\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"Equals\",\r\n \"GreaterThan\",\r\n \"GreaterThanOrEqual\",\r\n \"LessThan\",\r\n \"LessThanOrEqual\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Average\",\r\n \"Count\",\r\n \"Maximum\",\r\n \"Minimum\",\r\n \"Total\"\r\n ],\r\n \"defaultValue\": \"Average\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"50\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Disks to be included to be monitored\",\r\n \"description\": \"Array of Computer to be monitored\"\r\n },\r\n \"defaultValue\": [\r\n \"*\"\r\n ]\r\n },\r\n \"disksToInclude\": {\r\n \"type\": \"array\",\r\n \"metadata\": {\r\n \"displayName\": \"Disks to be included to be monitored\",\r\n \"description\": \"Array of disk to be monitored for disk both windows and linux\"\r\n },\r\n \"defaultValue\": [\r\n \"C:\",\r\n \"/\"\r\n ]\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourcegroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMLowOSDiskwriteLatencyAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"InsightsMetrics| where Origin == \\\"vm.azm.ms\\\"| where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\"| extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"])| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"disksToInclude\": {\r\n \"type\": \"array\"\r\n },\r\n \"computersToInclude\": {\r\n \"type\": \"array\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"VMOSDiskwriteLatencyAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-HybridVMLowOSDiskwriteLatencyAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMLowOSDiskwriteLatencyAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine OSDiskwriteLatency\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.HybridCompute/machines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"InsightsMetrics| where Origin == \\\"vm.azm.ms\\\"| where Namespace == \\\"LogicalDisk\\\" and Name == \\\"WriteLatencyMs\\\"| extend Disk=tostring(todynamic(Tags)[\\\"vm.azm.ms/mountId\\\"])| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk\",\r\n \"metricMeasureColumn\": \"AggregatedValue\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('computersToInclude')]\"\r\n },\r\n {\r\n \"name\": \"Disk\",\r\n \"operator\": \"Include\",\r\n \"values\": \"[[parameters('disksToInclude')]\"\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"disksToInclude\": {\r\n \"value\": \"[[parameters('disksToInclude')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n \"disksToInclude\": {\r\n \"value\": \"[[parameters('disksToInclude')]\"\r\n },\r\n \"computersToInclude\": {\r\n \"value\": \"[[parameters('computersToInclude')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#98": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_CPU_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM CPU Alert\",\r\n \"description\": \"Policy to audit/deploy VM CPU Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.0.1\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"AlzMonitoring-rg\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"environment\": \"test\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"Equals\",\r\n \"GreaterThan\",\r\n \"GreaterThanOrEqual\",\r\n \"LessThan\",\r\n \"LessThanOrEqual\"\r\n ],\r\n \"defaultValue\": \"GreaterThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Average\",\r\n \"Count\",\r\n \"Maximum\",\r\n \"Minimum\",\r\n \"Total\"\r\n ],\r\n \"defaultValue\": \"Average\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"85\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourcegroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMHighCPUAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"1\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"InsightsMetrics| where Origin == \\\"vm.azm.ms\\\"| where Namespace == \\\"Processor\\\" and Name == \\\"UtilizationPercentage\\\"| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"VMCPUAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-HybridVMHighCPUAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMHighCPUAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine CPU\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.HybridCompute/machines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"InsightsMetrics| where Origin == \\\"vm.azm.ms\\\"| where Namespace == \\\"Processor\\\" and Name == \\\"UtilizationPercentage\\\"| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId\",\r\n \"metricMeasureColumn\": \"AggregatedValue\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"1\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "$fxv#99": "{\r\n \"type\": \"Microsoft.Authorization/policyDefinitions\",\r\n \"apiVersion\": \"2021-06-01\",\r\n \"name\": \"Deploy_Hybrid_VM_Memory_Alert\",\r\n \"properties\": {\r\n \"policyType\": \"Custom\",\r\n \"mode\": \"All\",\r\n \"displayName\": \"Deploy Hybrid VM Memory Alert\",\r\n \"description\": \"Policy to audit/deploy VM Memory Alert\",\r\n \"metadata\": {\r\n \"version\": \"1.0.1\",\r\n \"category\": \"Hybrid Compute\",\r\n \"source\": \"https://github.com/Azure/azure-monitor-baseline-alerts/\",\r\n \"alzCloudEnvironments\": [\r\n \"AzureCloud\"\r\n ],\r\n \"_deployed_by_amba\": \"True\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Name\",\r\n \"description\": \"Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"AlzMonitoring-rg\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"Object\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Tags\",\r\n \"description\": \"Tags on the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": {\r\n \"environment\": \"test\"\r\n }\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Resource Group Location\",\r\n \"description\": \"Location of the Resource group the alert is placed in\"\r\n },\r\n \"defaultValue\": \"centralus\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Severity\",\r\n \"description\": \"Severity of the Alert\"\r\n },\r\n \"allowedValues\": [\r\n \"0\",\r\n \"1\",\r\n \"2\",\r\n \"3\",\r\n \"4\"\r\n ],\r\n \"defaultValue\": \"2\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Operator\"\r\n },\r\n \"allowedValues\": [\r\n \"Equals\",\r\n \"GreaterThan\",\r\n \"GreaterThanOrEqual\",\r\n \"LessThan\",\r\n \"LessThanOrEqual\"\r\n ],\r\n \"defaultValue\": \"LessThan\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"TimeAggregation\"\r\n },\r\n \"allowedValues\": [\r\n \"Average\",\r\n \"Count\",\r\n \"Maximum\",\r\n \"Minimum\",\r\n \"Total\"\r\n ],\r\n \"defaultValue\": \"Average\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Window Size\",\r\n \"description\": \"Window size for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\",\r\n \"PT6H\",\r\n \"PT12H\",\r\n \"PT24H\"\r\n ],\r\n \"defaultValue\": \"PT15M\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Frequency\",\r\n \"description\": \"Evaluation frequency for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"PT5M\",\r\n \"PT15M\",\r\n \"PT30M\",\r\n \"PT1H\"\r\n ],\r\n \"defaultValue\": \"PT5M\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Mitigate\",\r\n \"description\": \"Auto Mitigate for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Auto Resolve\",\r\n \"description\": \"Auto Resolve time for the alert in ISO 8601 format\"\r\n },\r\n \"defaultValue\": \"true\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Alert State\",\r\n \"description\": \"Alert state for the alert\"\r\n },\r\n \"allowedValues\": [\r\n \"true\",\r\n \"false\"\r\n ],\r\n \"defaultValue\": \"true\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Threshold\",\r\n \"description\": \"Threshold for the alert\"\r\n },\r\n \"defaultValue\": \"10\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Failing Periods\",\r\n \"description\": \"Number of failing periods before alert is fired\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Evaluation Periods\",\r\n \"description\": \"The number of aggregated lookback points.\"\r\n },\r\n \"defaultValue\": \"1\"\r\n },\r\n \"effect\": {\r\n \"type\": \"String\",\r\n \"metadata\": {\r\n \"displayName\": \"Effect\",\r\n \"description\": \"Effect of the policy\"\r\n },\r\n \"allowedValues\": [\r\n \"deployIfNotExists\",\r\n \"disabled\"\r\n ],\r\n \"defaultValue\": \"deployIfNotExists\"\r\n }\r\n },\r\n \"policyRule\": {\r\n \"if\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"type\",\r\n \"equals\": \"Microsoft.HybridCompute/machines\"\r\n }\r\n ]\r\n },\r\n \"then\": {\r\n \"effect\": \"[[parameters('effect')]\",\r\n \"details\": {\r\n \"roleDefinitionIds\": [\r\n \"/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c\"\r\n ],\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"existenceScope\": \"resourcegroup\",\r\n \"resourceGroupName\": \"[[parameters('alertResourceGroupName')]\",\r\n \"deploymentScope\": \"subscription\",\r\n \"existenceCondition\": {\r\n \"allOf\": [\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/displayName\",\r\n \"equals\": \"[[concat(subscription().displayName, '-HybridVMLowMemoryAlert')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/scopes[*]\",\r\n \"equals\": \"[[subscription().id]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/enabled\",\r\n \"equals\": \"[[parameters('enabled')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/evaluationFrequency\",\r\n \"equals\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/windowSize\",\r\n \"equals\": \"[[parameters('windowSize')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/severity\",\r\n \"equals\": \"[[parameters('severity')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledqueryrules/autoMitigate\",\r\n \"equals\": \"[[parameters('autoMitigate')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold\",\r\n \"equals\": \"[[parameters('threshold')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator\",\r\n \"equals\": \"[[parameters('operator')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].timeAggregation\",\r\n \"equals\": \"[[parameters('timeAggregation')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods\",\r\n \"equals\": \"[[parameters('evaluationPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert\",\r\n \"equals\": \"[[parameters('failingPeriods')]\"\r\n },\r\n {\r\n \"field\": \"Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query\",\r\n \"equals\": \"InsightsMetrics| where Origin == \\\"vm.azm.ms\\\"|where Namespace == \\\"Memory\\\" and Name == \\\"AvailableMB\\\"| extend TotalMemory = toreal(todynamic(Tags)[\\\"vm.azm.ms/memorySizeMB\\\"]) | extend AvailableMemoryPercentage = (toreal(Val) / TotalMemory) * 100.0| summarize AggregatedValue = avg(AvailableMemoryPercentage) by bin(TimeGenerated, 15m), Computer, _ResourceId\"\r\n }\r\n ]\r\n },\r\n \"deployment\": {\r\n \"location\": \"northeurope\",\r\n \"properties\": {\r\n \"mode\": \"incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"type\": \"object\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n },\r\n \"severity\": {\r\n \"type\": \"String\"\r\n },\r\n \"windowSize\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoMitigate\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolve\": {\r\n \"type\": \"String\"\r\n },\r\n \"autoResolveTime\": {\r\n \"type\": \"String\"\r\n },\r\n \"enabled\": {\r\n \"type\": \"String\"\r\n },\r\n \"threshold\": {\r\n \"type\": \"String\"\r\n },\r\n \"operator\": {\r\n \"type\": \"String\"\r\n },\r\n \"timeAggregation\": {\r\n \"type\": \"String\"\r\n },\r\n \"failingPeriods\": {\r\n \"type\": \"String\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"type\": \"String\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Resources/resourceGroups\",\r\n \"apiVersion\": \"2021-04-01\",\r\n \"name\": \"[[parameters('alertResourceGroupName')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n {\r\n \"type\": \"Microsoft.Resources/deployments\",\r\n \"apiVersion\": \"2019-10-01\",\r\n \"name\": \"VMMemoryAlert\",\r\n \"resourceGroup\": \"[[parameters('alertResourceGroupName')]\",\r\n \"dependsOn\": [\r\n \"[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]\"\r\n ],\r\n \"properties\": {\r\n \"mode\": \"Incremental\",\r\n \"template\": {\r\n \"$schema\": \"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#\",\r\n \"contentVersion\": \"1.0.0.0\",\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"type\": \"string\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"type\": \"string\"\r\n }\r\n },\r\n \"variables\": {},\r\n \"resources\": [\r\n {\r\n \"type\": \"Microsoft.Insights/scheduledQueryRules\",\r\n \"apiVersion\": \"2022-08-01-preview\",\r\n \"name\": \"[[concat(subscription().displayName, '-HybridVMLowMemoryAlert')]\",\r\n \"location\": \"[[parameters('alertResourceGroupLocation')]\",\r\n \"tags\": {\r\n \"_deployed_by_amba\": true\r\n },\r\n \"properties\": {\r\n \"displayName\": \"[[concat(subscription().displayName, '-HybridVMLowMemoryAlert')]\",\r\n \"description\": \"Log Alert for Virtual Machine Memory\",\r\n \"severity\": \"[[parameters('severity')]\",\r\n \"enabled\": \"[[parameters('enabled')]\",\r\n \"scopes\": [\r\n \"[[subscription().Id]\"\r\n ],\r\n \"targetResourceTypes\": [\r\n \"Microsoft.HybridCompute/machines\"\r\n ],\r\n \"evaluationFrequency\": \"[[parameters('evaluationFrequency')]\",\r\n \"windowSize\": \"[[parameters('windowSize')]\",\r\n \"criteria\": {\r\n \"allOf\": [\r\n {\r\n \"query\": \"InsightsMetrics| where Origin == \\\"vm.azm.ms\\\"|where Namespace == \\\"Memory\\\" and Name == \\\"AvailableMB\\\"| extend TotalMemory = toreal(todynamic(Tags)[\\\"vm.azm.ms/memorySizeMB\\\"]) | extend AvailableMemoryPercentage = (toreal(Val) / TotalMemory) * 100.0| summarize AggregatedValue = avg(AvailableMemoryPercentage) by bin(TimeGenerated, 15m), Computer, _ResourceId\",\r\n \"metricMeasureColumn\": \"AggregatedValue\",\r\n \"threshold\": \"[[parameters('threshold')]\",\r\n \"operator\": \"[[parameters('operator')]\",\r\n \"resourceIdColumn\": \"_ResourceId\",\r\n \"timeAggregation\": \"[[parameters('timeAggregation')]\",\r\n \"dimensions\": [\r\n {\r\n \"name\": \"Computer\",\r\n \"operator\": \"Include\",\r\n \"values\": [\r\n \"*\"\r\n ]\r\n }\r\n ],\r\n \"failingPeriods\": {\r\n \"numberOfEvaluationPeriods\": \"[[parameters('evaluationPeriods')]\",\r\n \"minFailingPeriodsToAlert\": \"[[parameters('failingPeriods')]\"\r\n }\r\n }\r\n ]\r\n },\r\n \"autoMitigate\": \"[[parameters('autoMitigate')]\",\r\n \"ruleResolveConfiguration\": {\r\n \"autoResolved\": \"[[parameters('autoResolve')]\",\r\n \"timeToResolve\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n }\r\n }\r\n }\r\n }\r\n ]\r\n },\r\n \"parameters\": {\r\n \"alertResourceGroupName\": {\r\n \"value\": \"[[parameters('alertResourceGroupName')]\"\r\n },\r\n \"alertResourceGroupTags\": {\r\n \"value\": \"[[parameters('alertResourceGroupTags')]\"\r\n },\r\n \"alertResourceGroupLocation\": {\r\n \"value\": \"[[parameters('alertResourceGroupLocation')]\"\r\n },\r\n \"severity\": {\r\n \"value\": \"[[parameters('severity')]\"\r\n },\r\n \"windowSize\": {\r\n \"value\": \"[[parameters('windowSize')]\"\r\n },\r\n \"evaluationFrequency\": {\r\n \"value\": \"[[parameters('evaluationFrequency')]\"\r\n },\r\n \"autoMitigate\": {\r\n \"value\": \"[[parameters('autoMitigate')]\"\r\n },\r\n \"autoResolve\": {\r\n \"value\": \"[[parameters('autoResolve')]\"\r\n },\r\n \"autoResolveTime\": {\r\n \"value\": \"[[parameters('autoResolveTime')]\"\r\n },\r\n \"enabled\": {\r\n \"value\": \"[[parameters('enabled')]\"\r\n },\r\n \"threshold\": {\r\n \"value\": \"[[parameters('threshold')]\"\r\n },\r\n \"operator\": {\r\n \"value\": \"[[parameters('operator')]\"\r\n },\r\n \"timeAggregation\": {\r\n \"value\": \"[[parameters('timeAggregation')]\"\r\n },\r\n \"failingPeriods\": {\r\n \"value\": \"[[parameters('failingPeriods')]\"\r\n },\r\n \"evaluationPeriods\": {\r\n \"value\": \"[[parameters('evaluationPeriods')]\"\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n }\r\n}\r\n", - "cloudEnv": "[environment().name]", - "defaultDeploymentLocationByCloudType": { - "AzureCloud": "northeurope", - "AzureChinaCloud": "chinaeast2", - "AzureUSGovernment": "usgovvirginia" - }, - "templateVars": { - "scope": "/providers/Microsoft.Management/managementGroups/contoso", - "defaultDeploymentLocation": "\"location\": \"northeurope\"", - "localizedDeploymentLocation": "[format('\"location\": \"{0}\"', variables('defaultDeploymentLocationByCloudType')[variables('cloudEnv')])]" - }, - "targetDeploymentLocationByCloudType": { - "AzureCloud": "[coalesce(parameters('location'), 'northeurope')]", - "AzureChinaCloud": "[coalesce(parameters('location'), 'chinaeast2')]", - "AzureUSGovernment": "[coalesce(parameters('location'), 'usgovvirginia')]" - }, - "deploymentLocation": "[format('\"location\": \"{0}\"', variables('targetDeploymentLocationByCloudType')[variables('cloudEnv')])]", - "loadPolicyDefinitions": { - "All": [ - "[variables('$fxv#0')]", - "[variables('$fxv#1')]", - "[variables('$fxv#2')]", - "[variables('$fxv#3')]", - "[variables('$fxv#4')]", - "[variables('$fxv#5')]", - "[variables('$fxv#6')]", - "[variables('$fxv#7')]", - "[variables('$fxv#8')]", - "[variables('$fxv#9')]", - "[variables('$fxv#10')]", - "[variables('$fxv#11')]", - "[variables('$fxv#12')]", - "[variables('$fxv#13')]", - "[variables('$fxv#14')]", - "[variables('$fxv#15')]", - "[variables('$fxv#16')]", - "[variables('$fxv#17')]", - "[variables('$fxv#18')]", - "[variables('$fxv#19')]", - "[variables('$fxv#20')]", - "[variables('$fxv#21')]", - "[variables('$fxv#22')]", - "[variables('$fxv#23')]", - "[variables('$fxv#24')]", - "[variables('$fxv#25')]", - "[variables('$fxv#26')]", - "[variables('$fxv#27')]", - "[variables('$fxv#28')]", - "[variables('$fxv#29')]", - "[variables('$fxv#30')]", - "[variables('$fxv#31')]", - "[variables('$fxv#32')]", - "[variables('$fxv#33')]", - "[variables('$fxv#34')]", - "[variables('$fxv#35')]", - "[variables('$fxv#36')]", - "[variables('$fxv#37')]", - "[variables('$fxv#38')]", - "[variables('$fxv#39')]", - "[variables('$fxv#40')]", - "[variables('$fxv#41')]", - "[variables('$fxv#42')]", - "[variables('$fxv#43')]", - "[variables('$fxv#44')]", - "[variables('$fxv#45')]", - "[variables('$fxv#46')]", - "[variables('$fxv#47')]", - "[variables('$fxv#48')]", - "[variables('$fxv#49')]", - "[variables('$fxv#50')]", - "[variables('$fxv#51')]", - "[variables('$fxv#52')]", - "[variables('$fxv#53')]", - "[variables('$fxv#54')]", - "[variables('$fxv#55')]", - "[variables('$fxv#56')]", - "[variables('$fxv#57')]", - "[variables('$fxv#58')]", - "[variables('$fxv#59')]", - "[variables('$fxv#60')]", - "[variables('$fxv#61')]", - "[variables('$fxv#62')]", - "[variables('$fxv#63')]", - "[variables('$fxv#64')]", - "[variables('$fxv#65')]", - "[variables('$fxv#66')]", - "[variables('$fxv#67')]", - "[variables('$fxv#68')]", - "[variables('$fxv#69')]", - "[variables('$fxv#70')]", - "[variables('$fxv#71')]", - "[variables('$fxv#72')]", - "[variables('$fxv#73')]", - "[variables('$fxv#74')]", - "[variables('$fxv#75')]", - "[variables('$fxv#76')]", - "[variables('$fxv#77')]", - "[variables('$fxv#78')]", - "[variables('$fxv#79')]", - "[variables('$fxv#80')]", - "[variables('$fxv#81')]", - "[variables('$fxv#82')]", - "[variables('$fxv#83')]", - "[variables('$fxv#84')]", - "[variables('$fxv#85')]", - "[variables('$fxv#86')]", - "[variables('$fxv#87')]", - "[variables('$fxv#88')]", - "[variables('$fxv#89')]", - "[variables('$fxv#90')]", - "[variables('$fxv#91')]", - "[variables('$fxv#92')]", - "[variables('$fxv#93')]", - "[variables('$fxv#94')]", - "[variables('$fxv#95')]", - "[variables('$fxv#96')]", - "[variables('$fxv#97')]", - "[variables('$fxv#98')]", - "[variables('$fxv#99')]", - "[variables('$fxv#100')]", - "[variables('$fxv#101')]", - "[variables('$fxv#102')]", - "[variables('$fxv#103')]", - "[variables('$fxv#104')]", - "[variables('$fxv#105')]", - "[variables('$fxv#106')]", - "[variables('$fxv#107')]", - "[variables('$fxv#108')]", - "[variables('$fxv#109')]", - "[variables('$fxv#110')]", - "[variables('$fxv#111')]", - "[variables('$fxv#112')]", - "[variables('$fxv#113')]", - "[variables('$fxv#114')]" - ], - "AzureCloud": [], - "AzureChinaCloud": [], - "AzureUSGovernment": [] - }, - "loadPolicySetDefinitions": { - "All": [ - "[string(variables('$fxv#115'))]", - "[string(variables('$fxv#116'))]", - "[string(variables('$fxv#117'))]", - "[string(variables('$fxv#118'))]", - "[string(variables('$fxv#119'))]", - "[string(variables('$fxv#120'))]", - "[string(variables('$fxv#121'))]" - ], - "AzureCloud": [], - "AzureChinaCloud": [], - "AzureUSGovernment": [] - }, - "policyDefinitionsByCloudType": { - "All": "[variables('policyDefinitionsAll')]", - "AzureCloud": "[variables('policyDefinitionsAzureCloud')]", - "AzureChinaCloud": "[variables('policyDefinitionsAzureChinaCloud')]", - "AzureUSGovernment": "[variables('policyDefinitionsAzureUSGovernment')]" - }, - "policySetDefinitionsByCloudType": { - "All": "[variables('policySetDefinitionsAll')]", - "AzureCloud": "[variables('policySetDefinitionsAzureCloud')]", - "AzureChinaCloud": "[variables('policySetDefinitionsAzureChinaCloud')]", - "AzureUSGovernment": "[variables('policySetDefinitionsAzureUSGovernment')]" - }, - "policyDefinitions": "[concat(variables('policyDefinitionsByCloudType').All, variables('policyDefinitionsByCloudType')[variables('cloudEnv')])]", - "policySetDefinitions": "[concat(variables('policySetDefinitionsByCloudType').All, variables('policySetDefinitionsByCloudType')[variables('cloudEnv')])]" - }, - "resources": [ - { - "copy": { - "name": "PolicyDefinitions", - "count": "[length(variables('policyDefinitions'))]" - }, - "type": "Microsoft.Authorization/policyDefinitions", - "apiVersion": "2020-09-01", - "name": "[variables('policyDefinitions')[copyIndex()].name]", - "properties": { - "description": "[variables('policyDefinitions')[copyIndex()].properties.description]", - "displayName": "[variables('policyDefinitions')[copyIndex()].properties.displayName]", - "metadata": "[variables('policyDefinitions')[copyIndex()].properties.metadata]", - "mode": "[variables('policyDefinitions')[copyIndex()].properties.mode]", - "parameters": "[variables('policyDefinitions')[copyIndex()].properties.parameters]", - "policyType": "[variables('policyDefinitions')[copyIndex()].properties.policyType]", - "policyRule": "[variables('policyDefinitions')[copyIndex()].properties.policyRule]" - } - }, - { - "copy": { - "name": "PolicySetDefinitions", - "count": "[length(variables('policySetDefinitions'))]" - }, - "type": "Microsoft.Authorization/policySetDefinitions", - "apiVersion": "2020-09-01", - "name": "[variables('policySetDefinitions')[copyIndex()].name]", - "properties": { - "description": "[variables('policySetDefinitions')[copyIndex()].properties.description]", - "displayName": "[variables('policySetDefinitions')[copyIndex()].properties.displayName]", - "metadata": "[variables('policySetDefinitions')[copyIndex()].properties.metadata]", - "parameters": "[variables('policySetDefinitions')[copyIndex()].properties.parameters]", - "policyType": "[variables('policySetDefinitions')[copyIndex()].properties.policyType]", - "policyDefinitions": "[variables('policySetDefinitions')[copyIndex()].properties.policyDefinitions]", - "policyDefinitionGroups": "[variables('policySetDefinitions')[copyIndex()].properties.policyDefinitionGroups]" - }, - "dependsOn": [ - "PolicyDefinitions" - ] - } - ], - "outputs": { - "policyDefinitionNames": { - "type": "array", - "copy": { - "count": "[length(variables('policyDefinitions'))]", - "input": "[variables('policyDefinitions')[copyIndex()].name]" - } - }, - "policySetDefinitionNames": { - "type": "array", - "copy": { - "count": "[length(variables('policySetDefinitions'))]", - "input": "[variables('policySetDefinitions')[copyIndex()].name]" - } - } - } -} \ No newline at end of file diff --git a/patterns/alz/policyDefinitions/policySets.json b/patterns/alz/policyDefinitions/policySets.json new file mode 100644 index 000000000..998f1e082 --- /dev/null +++ b/patterns/alz/policyDefinitions/policySets.json @@ -0,0 +1,6334 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-08-01/managementGroupDeploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.29.47.4906", + "templateHash": "2221949666148884807" + } + }, + "parameters": { + "topLevelManagementGroupPrefix": { + "type": "string", + "defaultValue": "alz", + "metadata": { + "message": "The JSON version of this file is programatically generated from Bicep. PLEASE DO NOT UPDATE MANUALLY!!", + "description": "Provide a prefix (unique at tenant-scope) for the Management Group hierarchy and other resources created as part of an Azure landing zone. DEFAULT VALUE = \"alz\"" + } + }, + "location": { + "type": "string", + "defaultValue": "[deployment().location]", + "metadata": { + "description": "Optionally set the deployment location for policies with Deploy If Not Exists effect. DEFAULT VALUE = \"deployment().location\"" + } + }, + "scope": { + "type": "string", + "defaultValue": "[tenantResourceId('Microsoft.Management/managementGroups', parameters('topLevelManagementGroupPrefix'))]", + "metadata": { + "description": "Optionally set the scope for custom Policy Definitions used in Policy Set Definitions (Initiatives). Must be one of '/', '/subscriptions/id' or '/providers/Microsoft.Management/managementGroups/id'. DEFAULT VALUE = '/providers/Microsoft.Management/managementGroups/${topLevelManagementGroupPrefix}'" + } + } + }, + "variables": { + "copy": [ + { + "name": "processPolicyDefinitionsAll", + "count": "[length(variables('loadPolicyDefinitions').All)]", + "input": "[replace(replace(variables('loadPolicyDefinitions').All[copyIndex('processPolicyDefinitionsAll')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" + }, + { + "name": "processPolicyDefinitionsAzureCloud", + "count": "[length(variables('loadPolicyDefinitions').AzureCloud)]", + "input": "[replace(replace(variables('loadPolicyDefinitions').AzureCloud[copyIndex('processPolicyDefinitionsAzureCloud')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" + }, + { + "name": "processPolicyDefinitionsAzureChinaCloud", + "count": "[length(variables('loadPolicyDefinitions').AzureChinaCloud)]", + "input": "[replace(replace(variables('loadPolicyDefinitions').AzureChinaCloud[copyIndex('processPolicyDefinitionsAzureChinaCloud')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" + }, + { + "name": "processPolicyDefinitionsAzureUSGovernment", + "count": "[length(variables('loadPolicyDefinitions').AzureUSGovernment)]", + "input": "[replace(replace(variables('loadPolicyDefinitions').AzureUSGovernment[copyIndex('processPolicyDefinitionsAzureUSGovernment')], variables('templateVars').defaultDeploymentLocation, variables('deploymentLocation')), variables('templateVars').localizedDeploymentLocation, variables('deploymentLocation'))]" + }, + { + "name": "processPolicySetDefinitionsAll", + "count": "[length(variables('loadPolicySetDefinitions').All)]", + "input": "[replace(variables('loadPolicySetDefinitions').All[copyIndex('processPolicySetDefinitionsAll')], variables('templateVars').scope, parameters('scope'))]" + }, + { + "name": "processPolicySetDefinitionsAzureCloud", + "count": "[length(variables('loadPolicySetDefinitions').AzureCloud)]", + "input": "[replace(variables('loadPolicySetDefinitions').AzureCloud[copyIndex('processPolicySetDefinitionsAzureCloud')], variables('templateVars').scope, parameters('scope'))]" + }, + { + "name": "processPolicySetDefinitionsAzureChinaCloud", + "count": "[length(variables('loadPolicySetDefinitions').AzureChinaCloud)]", + "input": "[replace(variables('loadPolicySetDefinitions').AzureChinaCloud[copyIndex('processPolicySetDefinitionsAzureChinaCloud')], variables('templateVars').scope, parameters('scope'))]" + }, + { + "name": "processPolicySetDefinitionsAzureUSGovernment", + "count": "[length(variables('loadPolicySetDefinitions').AzureUSGovernment)]", + "input": "[replace(variables('loadPolicySetDefinitions').AzureUSGovernment[copyIndex('processPolicySetDefinitionsAzureUSGovernment')], variables('templateVars').scope, parameters('scope'))]" + }, + { + "name": "policyDefinitionsAll", + "count": "[length(variables('processPolicyDefinitionsAll'))]", + "input": "[json(variables('processPolicyDefinitionsAll')[copyIndex('policyDefinitionsAll')])]" + }, + { + "name": "policyDefinitionsAzureCloud", + "count": "[length(variables('processPolicyDefinitionsAzureCloud'))]", + "input": "[json(variables('processPolicyDefinitionsAzureCloud')[copyIndex('policyDefinitionsAzureCloud')])]" + }, + { + "name": "policyDefinitionsAzureChinaCloud", + "count": "[length(variables('processPolicyDefinitionsAzureChinaCloud'))]", + "input": "[json(variables('processPolicyDefinitionsAzureChinaCloud')[copyIndex('policyDefinitionsAzureChinaCloud')])]" + }, + { + "name": "policyDefinitionsAzureUSGovernment", + "count": "[length(variables('processPolicyDefinitionsAzureUSGovernment'))]", + "input": "[json(variables('processPolicyDefinitionsAzureUSGovernment')[copyIndex('policyDefinitionsAzureUSGovernment')])]" + }, + { + "name": "policySetDefinitionsAll", + "count": "[length(variables('processPolicySetDefinitionsAll'))]", + "input": "[json(variables('processPolicySetDefinitionsAll')[copyIndex('policySetDefinitionsAll')])]" + }, + { + "name": "policySetDefinitionsAzureCloud", + "count": "[length(variables('processPolicySetDefinitionsAzureCloud'))]", + "input": "[json(variables('processPolicySetDefinitionsAzureCloud')[copyIndex('policySetDefinitionsAzureCloud')])]" + }, + { + "name": "policySetDefinitionsAzureChinaCloud", + "count": "[length(variables('processPolicySetDefinitionsAzureChinaCloud'))]", + "input": "[json(variables('processPolicySetDefinitionsAzureChinaCloud')[copyIndex('policySetDefinitionsAzureChinaCloud')])]" + }, + { + "name": "policySetDefinitionsAzureUSGovernment", + "count": "[length(variables('processPolicySetDefinitionsAzureUSGovernment'))]", + "input": "[json(variables('processPolicySetDefinitionsAzureUSGovernment')[copyIndex('policySetDefinitionsAzureUSGovernment')])]" + } + ], + "$fxv#0": { + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "name": "Alerting-LandingZone", + "properties": { + "displayName": "[Deprecated]: Deploy Azure Monitor Baseline Alerts for Landing Zone", + "description": "Initiative to deploy AMBA alerts relevant to the ALZ LandingZone management group", + "metadata": { + "version": "1.1.0-deprecated", + "category": "Monitoring", + "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", + "deprecated": true, + "supersededBy": "Alerting-KeyManagement, Alerting-LoadBalancing, Alerting-NetworkChanges, Alerting-RecoveryServices, Alerting-Storage, Alerting-VM, Alerting-Web", + "alzCloudEnvironments": [ + "AzureCloud" + ], + "_deployed_by_amba": true + }, + "parameters": { + "ALZMonitorResourceGroupName": { + "type": "String", + "defaultValue": "ALZ-Monitoring-RG", + "metadata": { + "displayName": "ALZ Monitor Resource Group Name", + "description": "Name of the resource group where the ALZ Monitor resources will be deployed" + } + }, + "ALZMonitorResourceGroupTags": { + "type": "Object", + "defaultValue": { + "_deployed_by_alz_monitor": true + }, + "metadata": { + "displayName": "ALZ Monitor Resource Group Tags", + "description": "Tags for the resource group where the ALZ Monitor resources will be deployed" + } + }, + "ALZMonitorResourceGroupLocation": { + "type": "String", + "defaultValue": "centralus", + "metadata": { + "displayName": "ALZ Monitor Resource Group Location", + "description": "Location of the resource group where the ALZ Monitor resources will be deployed" + } + }, + "KVRequestAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "Key Vault Request Alert Severity", + "description": "Severity of the alert for Key Vault Request" + } + }, + "KVRequestWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "Key Vault Request Window Size", + "description": "Window size for the alert" + } + }, + "KVRequestEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "Key Vault Request Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "KVRequestPolicyEffect": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Key Vault Request Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "KVRequestAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Key Vault Request Alert State", + "description": "Alert state for the alert" + } + }, + "KvAvailabilityAlertSeverity": { + "type": "String", + "defaultValue": "1", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "Key Vault Availability Alert Severity", + "description": "Severity of the alert for Key Vault Availability" + } + }, + "KvAvailabilityWindowSize": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "Key Vault Availability Window Size", + "description": "Window size for the alert" + } + }, + "KvAvailabilityEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "Key Vault Availability Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "KvAvailabilityPolicyEffect": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Key Vault Availability Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "KvAvailabilityAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Key Vault Availability Alert State", + "description": "Alert state for the alert" + } + }, + "KVAvailabilityThreshold": { + "type": "string", + "defaultValue": "20", + "metadata": { + "displayName": "Key Vault Availability Threshold", + "description": "Threshold for the alert" + } + }, + "KvLatencyAvailabilityAlertSeverity": { + "type": "String", + "defaultValue": "3", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "Key Vault Latency Availability Alert Severity", + "description": "Severity of the alert for Key Vault Latency Availability" + } + }, + "KvLatencyAvailabilityWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "Key Vault Latency Availability Window Size", + "description": "Window size for the alert" + } + }, + "KvLatencyAvailabilityEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "Key Vault Latency Availability Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "KvLatencyAvailabilityPolicyEffect": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Key Vault Latency Availability Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "KvLatencyAvailabilityAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Key Vault Latency Availability Alert State", + "description": "Alert state for the alert" + } + }, + "KvLatencyAvailabilityThreshold": { + "type": "string", + "defaultValue": "1000", + "metadata": { + "displayName": "Key Vault Latency Availability Threshold", + "description": "Threshold for the alert" + } + }, + "KVCapacityAlertSeverity": { + "type": "String", + "defaultValue": "1", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "Key Vault Capacity Alert Severity", + "description": "Severity of the alert for Key Vault Capacity" + } + }, + "KVCapacityWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "Key Vault Capacity Window Size", + "description": "Window size for the alert" + } + }, + "KVCapacityEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "Key Vault Capacity Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "KVCapacityPolicyEffect": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Key Vault Capacity Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "KVCapacityAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Key Vault Capacity Alert State", + "description": "Alert state for the alert" + } + }, + "KVCapacityThreshold": { + "type": "string", + "defaultValue": "75", + "metadata": { + "displayName": "Key Vault Capacity Threshold", + "description": "Threshold for the alert" + } + }, + "activityKVDeleteAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Activity Key Vault Delete Alert State", + "description": "Alert state for the alert" + } + }, + "StorageAccountAvailabilityAlertSeverity": { + "type": "String", + "defaultValue": "1", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "Storage Account Availability Alert Severity", + "description": "Severity of the alert for Storage Account Availability" + } + }, + "StorageAccountAvailabilityWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "Storage Account Availability Window Size", + "description": "Window size for the alert" + } + }, + "StorageAccountAvailabilityFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "Storage Account Availability Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "StorageAccountAvailabilityPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Storage Account Availability Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "StorageAccountAvailabilityAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Storage Account Availability Alert State", + "description": "Alert state for the alert" + } + }, + "StorageAccountAvailabilityThreshold": { + "type": "string", + "defaultValue": "90", + "metadata": { + "displayName": "Storage Account Availability Threshold", + "description": "Threshold for the alert" + } + }, + "StorageAccountDeletePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Storage Account Delete Alert Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will create the alert if it does not exist, disabled will not create the alert" + } + }, + "StorageAccountDeleteAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Storage Account Delete Alert State", + "description": "Alert state for the alert" + } + }, + "PIPDDoSAttackAlertSeverity": { + "type": "String", + "defaultValue": "1", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "PIP DDoS Attack Alert Severity", + "description": "Severity of the alert for PIP DDoS Attack" + } + }, + "PIPDDoSAttackWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "PIP DDoS Attack Window Size", + "description": "Window size for the alert" + } + }, + "PIPDDoSAttackEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "PIP DDoS Attack Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "PIPDDoSAttackPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "PIP DDoS Attack Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "PIPDDoSAttackAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "PIP DDoS Attack Alert State", + "description": "Alert state for the alert" + } + }, + "PIPDDoSAttackThreshold": { + "type": "string", + "defaultValue": "0", + "metadata": { + "displayName": "PIP DDoS Attack Threshold", + "description": "Threshold for the alert" + } + }, + "PIPPacketsInDDoSAlertSeverity": { + "type": "String", + "defaultValue": "4", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "PIP Packets In DDoS Alert Severity", + "description": "Severity of the alert for PIP Packets In DDoS" + } + }, + "PIPPacketsInDDoSWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "PIP Packets In DDoS Window Size", + "description": "Window size for the alert" + } + }, + "PIPPacketsInDDoSEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "PIP Packets In DDoS Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "PIPPacketsInDDoSPolicyEffect": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "PIP Packets In DDoS Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "PIPPacketsInDDoSAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "PIP Packets In DDoS Alert State", + "description": "Alert state for the alert" + } + }, + "PIPPacketsInDDoSThreshold": { + "type": "string", + "defaultValue": "40000", + "metadata": { + "displayName": "PIP Packets In DDoS Threshold", + "description": "Threshold for the alert" + } + }, + "PIPVIPAvailabilityAlertSeverity": { + "type": "String", + "defaultValue": "1", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "PIP VIP Availability Alert Severity", + "description": "Severity of the alert for PIP VIP Availability" + } + }, + "PIPVIPAvailabilityWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "PIP VIP Availability Window Size", + "description": "Window size for the alert" + } + }, + "PIPVIPAvailabilityEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "PIP VIP Availability Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "PIPVIPAvailabilityPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "PIP VIP Availability Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "PIPVIPAvailabilityAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "PIP VIP Availability Alert State", + "description": "Alert state for the alert" + } + }, + "PIPVIPAvailabilityThreshold": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "PIP VIP Availability Threshold", + "description": "Threshold for the alert" + } + }, + "PIPBytesInDDoSAlertSeverity": { + "type": "String", + "defaultValue": "4", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "PIP Bytes In DDoS Alert Severity", + "description": "Severity of the alert for PIP Bytes In DDoS" + } + }, + "PIPBytesInDDoSWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "PIP Bytes In DDoS Window Size", + "description": "Window size for the alert" + } + }, + "PIPBytesInDDoSEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "PIP Bytes In DDoS Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "PIPBytesInDDoSPolicyEffect": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "PIP Bytes In DDoS Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "PIPBytesInDDoSAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "PIP Bytes In DDoS Alert State", + "description": "Alert state for the alert" + } + }, + "PIPBytesInDDoSThreshold": { + "type": "string", + "defaultValue": "8000000", + "metadata": { + "displayName": "PIP Bytes In DDoS Threshold", + "description": "Threshold for the alert" + } + }, + "RVBackupHealthMonitorPolicyEffect": { + "type": "string", + "defaultValue": "modify", + "allowedValues": [ + "modify", + "audit", + "disabled" + ], + "metadata": { + "displayName": "Recovery Vault Backup Health Monitor Policy Effect", + "description": "Policy effect for the alert, modify will modify the alert if it exists, or audit if it does not exist" + } + }, + "VNETDDOSAttackAlertSeverity": { + "type": "String", + "defaultValue": "1", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "VNET DDoS Attack Alert Severity", + "description": "Severity of the alert for VNET DDoS Attack" + } + }, + "VNETDDOSAttackWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "VNET DDoS Attack Window Size", + "description": "Window size for the alert" + } + }, + "VNETDDOSAttackEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "VNET DDoS Attack Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VNETDDOSAttackPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "VNET DDoS Attack Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "VNETDDOSAttackAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VNET DDoS Attack Alert State", + "description": "Alert state for the alert" + } + }, + "VNETDDOSAttackThreshold": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VNET DDoS Attack Threshold", + "description": "Threshold for the alert" + } + }, + "activityNSGDeleteAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Activity NSG Delete Alert State", + "description": "Alert state for the alert" + } + }, + "activityUDRUpdateAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Activity UDR Update Alert State", + "description": "Alert state for the alert" + } + }, + "VMHeartBeatRGAlertSeverity": { + "type": "String", + "defaultValue": "1", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "VM Heart Beat RG Alert Severity", + "description": "Severity of the alert for VM Heart Beat RG" + } + }, + "VMHeartBeatRGWindowSize": { + "type": "string", + "defaultValue": "PT6H", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "VM Heart Beat RG Window Size", + "description": "Window size for the alert" + } + }, + "VMHeartBeatRGEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "VM Heart Beat RG Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VMHeartBeatRGAutoMitigate": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Heart Beat RG Auto Mitigate", + "description": "Auto Mitigate for the alert" + } + }, + "VMHeartBeatRGAutoResolve": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Heart Beat RG Auto Resolve", + "description": "Auto Resolve for the alert" + } + }, + "VMHeartBeatRGAutoResolveTime": { + "type": "string", + "defaultValue": "00:10:00", + "metadata": { + "displayName": "VM Heart Beat RG Auto Resolve Time", + "description": "Auto Resolve Time for the alert" + } + }, + "VMHeartBeatRGPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "VM Heart Beat RG Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "VMHeartBeatRGAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Heart Beat RG Alert State", + "description": "Alert state for the alert" + } + }, + "VMHeartBeatRGThreshold": { + "type": "string", + "defaultValue": "10", + "metadata": { + "displayName": "VM Heart Beat RG Threshold", + "description": "Threshold for the alert" + } + }, + "VMHeartBeatRGOperator": { + "type": "string", + "defaultValue": "GreaterThan", + "allowedValues": [ + "GreaterThan" + ], + "metadata": { + "displayName": "VM Heart Beat RG Operator", + "description": "Operator for the alert" + } + }, + "VMHeartBeatRGTimeAggregation": { + "type": "string", + "defaultValue": "Count", + "allowedValues": [ + "Count" + ], + "metadata": { + "displayName": "VM Heart Beat RG Time Aggregation", + "description": "Time Aggregation for the alert" + } + }, + "VMHeartBeatRGFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM Heart Beat RG Failing Periods", + "description": "Failing Periods for the alert" + } + }, + "VMNetworkInAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "VM Network In Alert Severity", + "description": "Severity of the alert for VM Network In" + } + }, + "VMNetworkInWindowSize": { + "type": "string", + "defaultValue": "PT15M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "VM Network In Window Size", + "description": "Window size for the alert" + } + }, + "VMNetworkInEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "VM Network In Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VMNetworkInAutoMitigate": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Network In Auto Mitigate", + "description": "Auto Mitigate for the alert" + } + }, + "VMNetworkInAutoResolve": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Network In Auto Resolve", + "description": "Auto Resolve for the alert" + } + }, + "VMNetworkInAutoResolveTime": { + "type": "string", + "defaultValue": "00:10:00", + "metadata": { + "displayName": "VM Network In Auto Resolve Time", + "description": "Auto Resolve Time for the alert" + } + }, + "VMNetworkInPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "VM Network In Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "VMNetworkInAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Network In Alert State", + "description": "Alert state for the alert" + } + }, + "VMNetworkInThreshold": { + "type": "string", + "defaultValue": "10000000", + "metadata": { + "displayName": "VM Network In Threshold", + "description": "Threshold for the alert" + } + }, + "VMNetworkInOperator": { + "type": "string", + "defaultValue": "GreaterThan", + "allowedValues": [ + "GreaterThan" + ], + "metadata": { + "displayName": "VM Network In Operator", + "description": "Operator for the alert" + } + }, + "VMNetworkInTimeAggregation": { + "type": "string", + "defaultValue": "Count", + "allowedValues": [ + "Count" + ], + "metadata": { + "displayName": "VM Network In Time Aggregation", + "description": "Time Aggregation for the alert" + } + }, + "VMNetworkInEvaluationPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM Network In Evaluation Periods", + "description": "Evaluation Periods for the alert" + } + }, + "VMNetworkInFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM Network In Failing Periods", + "description": "Failing Periods for the alert" + } + }, + "VMNetworkInComputersToInclude": { + "type": "array", + "defaultValue": [ + "*" + ], + "metadata": { + "displayName": "VM Network In Computers To Include", + "description": "Computers To Include for the alert" + } + }, + "VMNetworkOutAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "VM Network Out Alert Severity", + "description": "Severity of the alert for VM Network Out" + } + }, + "VMNetworkOutWindowSize": { + "type": "string", + "defaultValue": "PT15M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "VM Network Out Window Size", + "description": "Window size for the alert" + } + }, + "VMNetworkOutEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "VM Network Out Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VMNetworkOutAutoMitigate": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Network Out Auto Mitigate", + "description": "Auto Mitigate for the alert" + } + }, + "VMNetworkOutAutoResolve": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Network Out Auto Resolve", + "description": "Auto Resolve for the alert" + } + }, + "VMNetworkOutAutoResolveTime": { + "type": "string", + "defaultValue": "00:10:00", + "metadata": { + "displayName": "VM Network Out Auto Resolve Time", + "description": "Auto Resolve Time for the alert" + } + }, + "VMNetworkOutPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "VM Network Out Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "VMNetworkOutAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Network Out Alert State", + "description": "Alert state for the alert, true will enable the alert, false will disable the alert" + } + }, + "VMNetworkOutThreshold": { + "type": "string", + "defaultValue": "10000000", + "metadata": { + "displayName": "VM Network Out Threshold", + "description": "Threshold for the alert" + } + }, + "VMNetworkOutOperator": { + "type": "string", + "defaultValue": "GreaterThan", + "allowedValues": [ + "GreaterThan" + ], + "metadata": { + "displayName": "VM Network Out Operator", + "description": "Operator for the alert" + } + }, + "VMNetworkOutTimeAggregation": { + "type": "string", + "defaultValue": "Count", + "allowedValues": [ + "Count" + ], + "metadata": { + "displayName": "VM Network Out Time Aggregation", + "description": "Time Aggregation for the alert" + } + }, + "VMNetworkOutEvaluationPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM Network Out Evaluation Periods", + "description": "Evaluation Periods for the alert" + } + }, + "VMNetworkOutFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM Network Out Failing Periods", + "description": "Failing Periods for the alert" + } + }, + "VMNetworkOutComputersToInclude": { + "type": "array", + "defaultValue": [ + "*" + ], + "metadata": { + "displayName": "VM Network Out Computers To Include", + "description": "Computers To Include for the alert" + } + }, + "VMOSDiskReadLatencyAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "VM OS Disk Read Latency Alert Severity", + "description": "Severity of the alert for VM OS Disk Read Latency" + } + }, + "VMOSDiskReadLatencyWindowSize": { + "type": "string", + "defaultValue": "PT15M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "VM OS Disk Read Latency Window Size", + "description": "Window size for the alert" + } + }, + "VMOSDiskReadLatencyEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "VM OS Disk Read Latency Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VMOSDiskReadLatencyAutoMitigate": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM OS Disk Read Latency Auto Mitigate", + "description": "Auto Mitigate for the alert" + } + }, + "VMOSDiskReadLatencyAutoResolve": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM OS Disk Read Latency Auto Resolve", + "description": "Auto Resolve for the alert" + } + }, + "VMOSDiskReadLatencyAutoResolveTime": { + "type": "string", + "defaultValue": "00:10:00", + "metadata": { + "displayName": "VM OS Disk Read Latency Auto Resolve Time", + "description": "Auto Resolve Time for the alert" + } + }, + "VMOSDiskReadLatencyPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "VM OS Disk Read Latency Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "VMOSDiskReadLatencyAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM OS Disk Read Latency Alert State", + "description": "Alert state for the alert, true will enable the alert, false will disable the alert" + } + }, + "VMOSDiskReadLatencyThreshold": { + "type": "string", + "defaultValue": "30", + "metadata": { + "displayName": "VM OS Disk Read Latency Threshold", + "description": "Threshold for the alert" + } + }, + "VMOSDiskReadLatencyOperator": { + "type": "string", + "defaultValue": "GreaterThan", + "allowedValues": [ + "GreaterThan" + ], + "metadata": { + "displayName": "VM OS Disk Read Latency Operator", + "description": "Operator for the alert" + } + }, + "VMOSDiskReadLatencyTimeAggregation": { + "type": "string", + "defaultValue": "Count", + "allowedValues": [ + "Count" + ], + "metadata": { + "displayName": "VM OS Disk Read Latency Time Aggregation", + "description": "Time Aggregation for the alert" + } + }, + "VMOSDiskReadLatencyEvaluationPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM OS Disk Read Latency Evaluation Periods", + "description": "Evaluation Periods for the alert" + } + }, + "VMOSDiskReadLatencyFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM OS Disk Read Latency Failing Periods", + "description": "Failing Periods for the alert" + } + }, + "VMOSDiskReadLatencyComputersToInclude": { + "type": "array", + "defaultValue": [ + "*" + ], + "metadata": { + "displayName": "VM OS Disk Read Latency Computers To Include", + "description": "Computers To Include for the alert" + } + }, + "VMOSDiskWriteLatencyAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "VM OS Disk Write Latency Alert Severity", + "description": "Severity of the alert for VM OS Disk Write Latency" + } + }, + "VMOSDiskWriteLatencyWindowSize": { + "type": "string", + "defaultValue": "PT15M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "VM OS Disk Write Latency Window Size", + "description": "Window size for the alert" + } + }, + "VMOSDiskWriteLatencyEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "VM OS Disk Write Latency Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VMOSDiskWriteLatencyAutoMitigate": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM OS Disk Write Latency Auto Mitigate", + "description": "Auto Mitigate for the alert" + } + }, + "VMOSDiskWriteLatencyAutoResolve": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM OS Disk Write Latency Auto Resolve", + "description": "Auto Resolve for the alert" + } + }, + "VMOSDiskWriteLatencyAutoResolveTime": { + "type": "string", + "defaultValue": "00:10:00", + "metadata": { + "displayName": "VM OS Disk Write Latency Auto Resolve Time", + "description": "Auto Resolve Time for the alert" + } + }, + "VMOSDiskWriteLatencyPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "VM OS Disk Write Latency Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "VMOSDiskWriteLatencyAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM OS Disk Write Latency Alert State", + "description": "Alert state for the alert, true will enable the alert, false will disable the alert" + } + }, + "VMOSDiskWriteLatencyThreshold": { + "type": "string", + "defaultValue": "30", + "metadata": { + "displayName": "VM OS Disk Write Latency Threshold", + "description": "Threshold for the alert" + } + }, + "VMOSDiskWriteLatencyOperator": { + "type": "string", + "defaultValue": "GreaterThan", + "allowedValues": [ + "GreaterThan" + ], + "metadata": { + "displayName": "VM OS Disk Write Latency Operator", + "description": "Operator for the alert" + } + }, + "VMOSDiskWriteLatencyTimeAggregation": { + "type": "string", + "defaultValue": "Count", + "allowedValues": [ + "Count" + ], + "metadata": { + "displayName": "VM OS Disk Write Latency Time Aggregation", + "description": "Time Aggregation for the alert" + } + }, + "VMOSDiskWriteLatencyEvaluationPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM OS Disk Write Latency Evaluation Periods", + "description": "Evaluation Periods for the alert" + } + }, + "VMOSDiskWriteLatencyFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM OS Disk Write Latency Failing Periods", + "description": "Failing Periods for the alert" + } + }, + "VMOSDiskWriteLatencyComputersToInclude": { + "type": "array", + "defaultValue": [ + "*" + ], + "metadata": { + "displayName": "VM OS Disk Write Latency Computers To Include", + "description": "Computers To Include for the alert" + } + }, + "VMOSDiskSpaceAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "VM OS Disk Space Alert Severity", + "description": "Severity of the alert for VM OS Disk Space" + } + }, + "VMOSDiskSpaceWindowSize": { + "type": "string", + "defaultValue": "PT15M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "VM OS Disk Space Window Size", + "description": "Window size for the alert" + } + }, + "VMOSDiskSpaceEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "VM OS Disk Space Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VMOSDiskSpaceAutoMitigate": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM OS Disk Space Auto Mitigate", + "description": "Auto Mitigate for the alert" + } + }, + "VMOSDiskSpaceAutoResolve": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM OS Disk Space Auto Resolve", + "description": "Auto Resolve for the alert" + } + }, + "VMOSDiskSpaceAutoResolveTime": { + "type": "string", + "defaultValue": "00:10:00", + "metadata": { + "displayName": "VM OS Disk Space Auto Resolve Time", + "description": "Auto Resolve Time for the alert" + } + }, + "VMOSDiskSpacePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "VM OS Disk Space Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "VMOSDiskSpaceAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM OS Disk Space Alert State", + "description": "Alert state for the alert, true will enable the alert, false will disable the alert" + } + }, + "VMOSDiskSpaceThreshold": { + "type": "string", + "defaultValue": "10", + "metadata": { + "displayName": "VM OS Disk Space Threshold", + "description": "Threshold for the alert" + } + }, + "VMOSDiskSpaceOperator": { + "type": "string", + "defaultValue": "GreaterThan", + "allowedValues": [ + "GreaterThan" + ], + "metadata": { + "displayName": "VM OS Disk Space Operator", + "description": "Operator for the alert" + } + }, + "VMOSDiskSpaceTimeAggregation": { + "type": "string", + "defaultValue": "Count", + "allowedValues": [ + "Count" + ], + "metadata": { + "displayName": "VM OS Disk Space Time Aggregation", + "description": "Time Aggregation for the alert" + } + }, + "VMOSDiskSpaceEvaluationPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM OS Disk Space Evaluation Periods", + "description": "Evaluation Periods for the alert" + } + }, + "VMOSDiskSpaceFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM OS Disk Space Failing Periods", + "description": "Failing Periods for the alert" + } + }, + "VMOSDiskSpaceComputersToInclude": { + "type": "array", + "defaultValue": [ + "*" + ], + "metadata": { + "displayName": "VM OS Disk Space Computers To Include", + "description": "Computers To Include for the alert" + } + }, + "VMPercentCPUAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "VM Percent CPU Alert Severity", + "description": "Severity of the alert for VM Percent CPU" + } + }, + "VMPercentCPUWindowSize": { + "type": "string", + "defaultValue": "PT15M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "VM Percent CPU Window Size", + "description": "Window size for the alert" + } + }, + "VMPercentCPUEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "VM Percent CPU Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VMPercentCPUAutoMitigate": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Percent CPU Auto Mitigate", + "description": "Auto Mitigate for the alert" + } + }, + "VMPercentCPUAutoResolve": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Percent CPU Auto Resolve", + "description": "Auto Resolve for the alert" + } + }, + "VMPercentCPUAutoResolveTime": { + "type": "string", + "defaultValue": "00:10:00", + "metadata": { + "displayName": "VM Percent CPU Auto Resolve Time", + "description": "Auto Resolve Time for the alert" + } + }, + "VMPercentCPUPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "VM Percent CPU Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "VMPercentCPUAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Percent CPU Alert State", + "description": "Alert state for the alert, true will enable the alert, false will disable the alert" + } + }, + "VMPercentCPUThreshold": { + "type": "string", + "defaultValue": "85", + "metadata": { + "displayName": "VM Percent CPU Threshold", + "description": "Threshold for the alert" + } + }, + "VMPercentCPUOperator": { + "type": "string", + "defaultValue": "GreaterThan", + "allowedValues": [ + "GreaterThan" + ], + "metadata": { + "displayName": "VM Percent CPU Operator", + "description": "Operator for the alert" + } + }, + "VMPercentCPUTimeAggregation": { + "type": "string", + "defaultValue": "Count", + "allowedValues": [ + "Count" + ], + "metadata": { + "displayName": "VM Percent CPU Time Aggregation", + "description": "Time Aggregation for the alert" + } + }, + "VMPercentCPUFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM Percent CPU Failing Periods", + "description": "Failing Periods for the alert" + } + }, + "VMPercentMemoryAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "VM Percent Memory Alert Severity", + "description": "Severity of the alert for VM Percent Memory" + } + }, + "VMPercentMemoryWindowSize": { + "type": "string", + "defaultValue": "PT15M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "VM Percent Memory Window Size", + "description": "Window size for the alert" + } + }, + "VMPercentMemoryEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "VM Percent Memory Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VMPercentMemoryAutoMitigate": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Percent Memory Auto Mitigate", + "description": "Auto Mitigate for the alert" + } + }, + "VMPercentMemoryAutoResolve": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Percent Memory Auto Resolve", + "description": "Auto Resolve for the alert" + } + }, + "VMPercentMemoryAutoResolveTime": { + "type": "string", + "defaultValue": "00:10:00", + "metadata": { + "displayName": "VM Percent Memory Auto Resolve Time", + "description": "Auto Resolve Time for the alert" + } + }, + "VMPercentMemoryPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "VM Percent Memory Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "VMPercentMemoryAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Percent Memory Alert State", + "description": "Alert state for the alert, true will enable the alert, false will disable the alert" + } + }, + "VMPercentMemoryThreshold": { + "type": "string", + "defaultValue": "10", + "metadata": { + "displayName": "VM Percent Memory Threshold", + "description": "Threshold for the alert" + } + }, + "VMPercentMemoryOperator": { + "type": "string", + "defaultValue": "GreaterThan", + "allowedValues": [ + "GreaterThan" + ], + "metadata": { + "displayName": "VM Percent Memory Operator", + "description": "Operator for the alert" + } + }, + "VMPercentMemoryTimeAggregation": { + "type": "string", + "defaultValue": "Count", + "allowedValues": [ + "Count" + ], + "metadata": { + "displayName": "VM Percent Memory Time Aggregation", + "description": "Time Aggregation for the alert" + } + }, + "VMDataDiskSpaceAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "VM Data Disk Space Alert Severity", + "description": "Severity of the alert for VM Data Disk Space" + } + }, + "VMDataDiskSpaceWindowSize": { + "type": "string", + "defaultValue": "PT15M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "VM Data Disk Space Window Size", + "description": "Window size for the alert" + } + }, + "VMDataDiskSpaceEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "VM Data Disk Space Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VMDataDiskSpaceAutoMitigate": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Data Disk Space Auto Mitigate", + "description": "Auto Mitigate for the alert" + } + }, + "VMDataDiskSpaceAutoResolve": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Data Disk Space Auto Resolve", + "description": "Auto Resolve for the alert" + } + }, + "VMDataDiskSpaceAutoResolveTime": { + "type": "string", + "defaultValue": "00:10:00", + "metadata": { + "displayName": "VM Data Disk Space Auto Resolve Time", + "description": "Auto Resolve Time for the alert" + } + }, + "VMDataDiskSpacePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "VM Data Disk Space Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "VMDataDiskSpaceAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Data Disk Space Alert State", + "description": "Alert state for the alert, true will enable the alert, false will disable the alert" + } + }, + "VMDataDiskSpaceThreshold": { + "type": "string", + "defaultValue": "10", + "metadata": { + "displayName": "VM Data Disk Space Threshold", + "description": "Threshold for the alert" + } + }, + "VMDataDiskSpaceOperator": { + "type": "string", + "defaultValue": "GreaterThan", + "allowedValues": [ + "GreaterThan" + ], + "metadata": { + "displayName": "VM Data Disk Space Operator", + "description": "Operator for the alert" + } + }, + "VMDataDiskSpaceTimeAggregation": { + "type": "string", + "defaultValue": "Count", + "allowedValues": [ + "Count" + ], + "metadata": { + "displayName": "VM Data Disk Space Time Aggregation", + "description": "Time Aggregation for the alert" + } + }, + "VMDataDiskSpaceEvaluationPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM Data Disk Space Evaluation Periods", + "description": "Evaluation Periods for the alert" + } + }, + "VMDataDiskSpaceFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM Data Disk Space Failing Periods", + "description": "Failing Periods for the alert" + } + }, + "VMDataDiskReadLatencyAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "VM Data Disk Read Latency Alert Severity", + "description": "Severity of the alert for VM Data Disk Read Latency" + } + }, + "VMDataDiskReadLatencyWindowSize": { + "type": "string", + "defaultValue": "PT15M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "VM Data Disk Read Latency Window Size", + "description": "Window size for the alert" + } + }, + "VMDataDiskReadLatencyEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "VM Data Disk Read Latency Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VMDataDiskReadLatencyAutoMitigate": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Data Disk Read Latency Auto Mitigate", + "description": "Auto Mitigate for the alert" + } + }, + "VMDataDiskReadLatencyAutoResolve": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Data Disk Read Latency Auto Resolve", + "description": "Auto Resolve for the alert" + } + }, + "VMDataDiskReadLatencyAutoResolveTime": { + "type": "string", + "defaultValue": "00:10:00", + "metadata": { + "displayName": "VM Data Disk Read Latency Auto Resolve Time", + "description": "Auto Resolve Time for the alert" + } + }, + "VMDataDiskReadLatencyPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "VM Data Disk Read Latency Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "VMDataDiskReadLatencyAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Data Disk Read Latency Alert State", + "description": "Alert state for the alert, true will enable the alert, false will disable the alert" + } + }, + "VMDataDiskReadLatencyThreshold": { + "type": "string", + "defaultValue": "30", + "metadata": { + "displayName": "VM Data Disk Read Latency Threshold", + "description": "Threshold for the alert" + } + }, + "VMDataDiskReadLatencyOperator": { + "type": "string", + "defaultValue": "GreaterThan", + "allowedValues": [ + "GreaterThan" + ], + "metadata": { + "displayName": "VM Data Disk Read Latency Operator", + "description": "Operator for the alert" + } + }, + "VMDataDiskReadLatencyTimeAggregation": { + "type": "string", + "defaultValue": "Count", + "allowedValues": [ + "Count" + ], + "metadata": { + "displayName": "VM Data Disk Read Latency Time Aggregation", + "description": "Time Aggregation for the alert" + } + }, + "VMDataDiskReadLatencyEvaluationPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM Data Disk Read Latency Evaluation Periods", + "description": "Evaluation Periods for the alert" + } + }, + "VMDataDiskReadLatencyFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM Data Disk Read Latency Failing Periods", + "description": "Failing Periods for the alert" + } + }, + "VMDataDiskReadLatencyComputersToInclude": { + "type": "array", + "defaultValue": [ + "*" + ], + "metadata": { + "displayName": "VM Data Disk Read Latency Computers To Include", + "description": "Computers To Include for the alert" + } + }, + "VMDataDiskWriteLatencyAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "VM Data Disk Write Latency Alert Severity", + "description": "Severity of the alert for VM Data Disk Write Latency" + } + }, + "VMDataDiskWriteLatencyWindowSize": { + "type": "string", + "defaultValue": "PT15M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "VM Data Disk Write Latency Window Size", + "description": "Window size for the alert" + } + }, + "VMDataDiskWriteLatencyEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "VM Data Disk Write Latency Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VMDataDiskWriteLatencyAutoMitigate": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Data Disk Write Latency Auto Mitigate", + "description": "Auto Mitigate for the alert" + } + }, + "VMDataDiskWriteLatencyAutoResolve": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Data Disk Write Latency Auto Resolve", + "description": "Auto Resolve for the alert" + } + }, + "VMDataDiskWriteLatencyAutoResolveTime": { + "type": "string", + "defaultValue": "00:10:00", + "metadata": { + "displayName": "VM Data Disk Write Latency Auto Resolve Time", + "description": "Auto Resolve Time for the alert" + } + }, + "VMDataDiskWriteLatencyPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "VM Data Disk Write Latency Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "VMDataDiskWriteLatencyAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Data Disk Write Latency Alert State", + "description": "Alert state for the alert, true will enable the alert, false will disable the alert" + } + }, + "VMDataDiskWriteLatencyThreshold": { + "type": "string", + "defaultValue": "30", + "metadata": { + "displayName": "VM Data Disk Write Latency Threshold", + "description": "Threshold for the alert" + } + }, + "VMDataDiskWriteLatencyOperator": { + "type": "string", + "defaultValue": "GreaterThan", + "allowedValues": [ + "GreaterThan" + ], + "metadata": { + "displayName": "VM Data Disk Write Latency Operator", + "description": "Operator for the alert" + } + }, + "VMDataDiskWriteLatencyTimeAggregation": { + "type": "string", + "defaultValue": "Count", + "allowedValues": [ + "Count" + ], + "metadata": { + "displayName": "VM Data Disk Write Latency Time Aggregation", + "description": "Time Aggregation for the alert" + } + }, + "VMDataDiskWriteLatencyEvaluationPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM Data Disk Write Latency Evaluation Periods", + "description": "Evaluation Periods for the alert" + } + }, + "VMDataDiskWriteLatencyFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM Data Disk Write Latency Failing Periods", + "description": "Failing Periods for the alert" + } + }, + "VMDataDiskWriteLatencyComputersToInclude": { + "type": "array", + "defaultValue": [ + "*" + ], + "metadata": { + "displayName": "VM Data Disk Write Latency Computers To Include", + "description": "Computers To Include for the alert" + } + }, + "AGWApplicationGatewayTotalTimeAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "AGW Total Time Alert Severity", + "description": "Severity of the alert" + } + }, + "AGWApplicationGatewayTotalTimeAlertSensitivity": { + "type": "String", + "defaultValue": "Medium", + "allowedValues": [ + "Low", + "Medium", + "High" + ], + "metadata": { + "displayName": "AGW Total Time Dynamic Alert Sensitivity", + "description": "Dynamic Sensitivity of the alert" + } + }, + "AGWApplicationGatewayTotalTimeWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "AGW Total Time Window Size", + "description": "Window size for the alert" + } + }, + "AGWApplicationGatewayTotalTimeEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "AGW Total Time Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "AGWApplicationGatewayTotalTimePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "AGW Total Time Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "AGWApplicationGatewayTotalTimeAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "AGW Total Time Alert State", + "description": "Alert state for the alert" + } + }, + "AGWBackendLastByteResponseTimeAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "AGW Backend Last Byte Response Time Alert Severity", + "description": "Severity of the alert" + } + }, + "AGWBackendLastByteResponseTimeAlertSensitivity": { + "type": "String", + "defaultValue": "Medium", + "allowedValues": [ + "Low", + "Medium", + "High" + ], + "metadata": { + "displayName": "AGW Backend Last Byte Response Time Dynamic Alert Sensitivity", + "description": "Dynamic Severity of the alert" + } + }, + "AGWBackendLastByteResponseTimeWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "AGW Backend Last Byte Response Time Window Size", + "description": "Window size for the alert" + } + }, + "AGWBackendLastByteResponseTimeEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "AGW Backend Last Byte Response Time Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "AGWBackendLastByteResponseTimePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "AGW Backend Last Byte Response Time Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "AGWBackendLastByteResponseTimeAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "AGW Backend Last Byte Response Time Alert State", + "description": "Alert state for the alert" + } + }, + "AGWCapacityUnitsAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "AGW Capacity Units Alert Severity", + "description": "Severity of the alert" + } + }, + "AGWCapacityUnitsWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "AGW Capacity Units Window Size", + "description": "Window size for the alert" + } + }, + "AGWCapacityUnitsEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "AGW Capacity Units Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "AGWCapacityUnitsPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "AGW Capacity Units Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "AGWCapacityUnitsAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "AGW Capacity Units Alert State", + "description": "Alert state for the alert" + } + }, + "AGWComputeUnitsAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "AGW Compute Units Alert Severity", + "description": "Severity of the alert" + } + }, + "AGWComputeUnitsWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "AGW Compute Units Window Size", + "description": "Window size for the alert" + } + }, + "AGWComputeUnitsEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "AGW Compute Units Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "AGWComputeUnitsPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "AGW Compute Units Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "AGWComputeUnitsAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "AGW Compute Units Alert State", + "description": "Alert state for the alert" + } + }, + "AGWCPUUtilAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "AGW CPU Util Alert Severity", + "description": "Severity of the alert" + } + }, + "AGWCPUUtilWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "AGW CPU Util Window Size", + "description": "Window size for the alert" + } + }, + "AGWCPUUtilEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "AGW CPU Util Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "AGWCPUUtilPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "AGW CPU Util Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "AGWCPUUtilAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "AGW CPU Util Alert State", + "description": "Alert state for the alert" + } + }, + "AGWFailedRequestsAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "AGW Failed Requests Alert Severity", + "description": "Severity of the alert" + } + }, + "AGWFailedRequestsAlertSensitivity": { + "type": "String", + "defaultValue": "Medium", + "allowedValues": [ + "Low", + "Medium", + "High" + ], + "metadata": { + "displayName": "AGW Failed Requests Dynamic Alert Sensitivity", + "description": "Dynamic Sensitivity of the alert" + } + }, + "AGWFailedRequestsWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "AGW Failed Requests Window Size", + "description": "Window size for the alert" + } + }, + "AGWFailedRequestsEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "AGW Failed Requests Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "AGWFailedRequestsPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "AGW Failed Requests Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "AGWFailedRequestsAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "AGW Failed Requests Alert State", + "description": "Alert state for the alert" + } + }, + "AGWResponseStatusAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "AGW Response Status Alert Severity", + "description": "Severity of the alert" + } + }, + "AGWResponseStatusAlertSensitivity": { + "type": "String", + "defaultValue": "Medium", + "allowedValues": [ + "Low", + "Medium", + "High" + ], + "metadata": { + "displayName": "AGW Response Status Dynamic Alert Sensitivity", + "description": "Dynamic Sensitivity of the alert" + } + }, + "AGWResponseStatusWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "AGW Response Status Window Size", + "description": "Window size for the alert" + } + }, + "AGWResponseStatusEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "AGW Response Status Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "AGWResponseStatusPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "AGW Response Status Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "AGWResponseStatusAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "AGW Response Status Alert State", + "description": "Alert state for the alert" + } + }, + "AGWUnhealthyHostCountAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "AGW Unhealthy Host Count Alert Severity", + "description": "Severity of the alert" + } + }, + "AGWUnhealthyHostCountWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "AGW Unhealthy Host Count Window Size", + "description": "Window size for the alert" + } + }, + "AGWUnhealthyHostCountEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "AGW Unhealthy Host Count Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "AGWUnhealthyHostCountPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "AGW Unhealthy Host Count Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "AGWUnhealthyHostCountAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "AGW Unhealthy Host Count Alert State", + "description": "Alert state for the alert" + } + }, + "LBDatapathAvailabilityAlertSeverity": { + "type": "String", + "defaultValue": "0", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "LB Data path Availability Alert Severity", + "description": "Severity of the alert" + } + }, + "LBDatapathAvailabilityWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "LB Data path Availability Window Size", + "description": "Window size for the alert" + } + }, + "LBDatapathAvailabilityEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "LB Data path Availability Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "LBDatapathAvailabilityPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "LB Data path Availability Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "LBDatapathAvailabilityAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "LB Data path Availability Alert State", + "description": "Alert state for the alert" + } + }, + "LBGlobalBackendAvailabilityAlertSeverity": { + "type": "String", + "defaultValue": "0", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "LB Global Backend Availability Alert Severity", + "description": "Severity of the alert" + } + }, + "LBGlobalBackendAvailabilityWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "LB Global Backend Availability Window Size", + "description": "Window size for the alert" + } + }, + "LBGlobalBackendAvailabilityEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "LB Global Backend Availability Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "LBGlobalBackendAvailabilityPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "LB Global Backend Availability Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "LBGlobalBackendAvailabilityAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "LB Global Backend Availability Alert State", + "description": "Alert state for the alert" + } + }, + "LBHealthProbeStatusAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "LB Health Probe Status Alert Severity", + "description": "Severity of the alert" + } + }, + "LBHealthProbeStatusWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "LB Health Probe Status Window Size", + "description": "Window size for the alert" + } + }, + "LBHealthProbeStatusEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "LB Health Probe Status Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "LBHealthProbeStatusPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "LB Health Probe Status Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "LBHealthProbeStatusAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "LB Health Probe Status Alert State", + "description": "Alert state for the alert" + } + }, + "LBUsedSNATPortsAlertSeverity": { + "type": "String", + "defaultValue": "1", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "LB Used SNAT Ports Alert Severity", + "description": "Severity of the alert" + } + }, + "LBUsedSNATPortsWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "LB Used SNAT Ports Window Size", + "description": "Window size for the alert" + } + }, + "LBUsedSNATPortsEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "LB Used SNAT Ports Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "LBUsedSNATPortsPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "LB Used SNAT Ports Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "LBUsedSNATPortsAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "LB Used SNAT Ports Alert State", + "description": "Alert state for the alert" + } + }, + "CDNPOriginHealthPercentageAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "CDN Origin Health Percentage Alert Severity", + "description": "Severity of the alert" + } + }, + "CDNPOriginHealthPercentageWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "CDN Origin Health Percentage Window Size", + "description": "Window size for the alert" + } + }, + "CDNPOriginHealthPercentageEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "CDN Origin Health Percentage Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "CDNPOriginHealthPercentagePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "CDN Origin Health Percentage Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "CDNPOriginHealthPercentageAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "CDN Origin Health Percentage Alert State", + "description": "Alert state for the alert" + } + }, + "CDNPOriginLatencyAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "CDN Origin Latancy Alert Severity", + "description": "Severity of the alert" + } + }, + "CDNPOriginLatencyWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "CDN Origin Latency Window Size", + "description": "Window size for the alert" + } + }, + "CDNPOriginLatencyEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "CDN Origin Latency Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "CDNPOriginLatencyPolicyEffect": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "CDN Origin Latency Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "CDNPOriginLatencyAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "CDN Origin Latency Alert State", + "description": "Alert state for the alert" + } + }, + "CDNPPercentage4XXAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "CDN Percentage 4XX Alert Severity", + "description": "Severity of the alert" + } + }, + "CDNPPercentage4XXWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "CDN Percentage 4XX Window Size", + "description": "Window size for the alert" + } + }, + "CDNPPercentage4XXEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "CDN Percentage 4XX Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "CDNPPercentage4XXPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "CDN Percentage 4XX Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "CDNPPercentage4XXAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "CDN Percentage 4XX Alert State", + "description": "Alert state for the alert" + } + }, + "CDNPPercentage5XXAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "CDN Percentage 5XX Alert Severity", + "description": "Severity of the alert" + } + }, + "CDNPPercentage5XXWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "CDN Percentage 5XX Window Size", + "description": "Window size for the alert" + } + }, + "CDNPPercentage5XXEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "CDN Percentage 5XX Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "CDNPPercentage5XXPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "CDN Percentage 5XX Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "CDNPPercentage5XXAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "CDN Percentage 5XX Alert State", + "description": "Alert state for the alert" + } + }, + "TMEndpointHealthAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "TM Enpoint Health Alert Severity", + "description": "Severity of the alert" + } + }, + "TMEndpointHealthWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "TM Enpoint Health Window Size", + "description": "Window size for the alert" + } + }, + "TMEndpointHealthEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "TM Enpoint Health Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "TMEndpointHealthPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "TM Enpoint Health Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "TMEndpointHealthAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "TM Enpoint Health Alert State", + "description": "Alert state for the alert" + } + }, + "WSFCPUPercentageAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "WSF CPU Percentage Alert Severity", + "description": "Severity of the alert" + } + }, + "WSFCPUPercentageWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "WSF CPU Percentage Window Size", + "description": "Window size for the alert" + } + }, + "WSFCPUPercentageEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "WSF CPU Percentage Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "WSFCPUPercentagePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "WSF CPU Percentage Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "WSFCPUPercentageAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "WSF CPU Percentage Alert State", + "description": "Alert state for the alert" + } + }, + "WSFMemoryPercentageAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "WSF Memory Percentage Alert Severity", + "description": "Severity of the alert" + } + }, + "WSFMemoryPercentageWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "WSF Memory Percentage Window Size", + "description": "Window size for the alert" + } + }, + "WSFMemoryPercentageEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "WSF Memory Percentage Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "WSFMemoryPercentagePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "WSF Memory Percentage Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "WSFMemoryPercentageAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "WSF Memory Percentage Alert State", + "description": "Alert state for the alert" + } + }, + "WSFDiskQueueLengthAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "WSF Disk Queue Lenght Alert Severity", + "description": "Severity of the alert" + } + }, + "WSFDiskQueueLengthWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "WSF Disk Queue Lenght Window Size", + "description": "Window size for the alert" + } + }, + "WSFDiskQueueLengthEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "WSF Disk Queue Lenght Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "WSFDiskQueueLengthPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "WSF Disk Queue Lenght Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "WSFDiskQueueLengthAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "WSF Disk Queue Lenght Alert State", + "description": "Alert state for the alert" + } + }, + "WSFHttpQueueLengthAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "WSF HTTP Queue Lenght Alert Severity", + "description": "Severity of the alert" + } + }, + "WSFHttpQueueLengthWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "WSF HTTP Queue Lenght Window Size", + "description": "Window size for the alert" + } + }, + "WSFHttpQueueLengthEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "WSF HTTP Queue Lenght Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "WSFHttpQueueLengthPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "WSF HTTP Queue Lenght Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "WSFHttpQueueLengthAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "WSF HTTP Queue Lenght Alert State", + "description": "Alert state for the alert" + } + }, + "FDBackendHealthAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "FD Backend Health Alert Severity", + "description": "Severity of the alert" + } + }, + "FDBackendHealthWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "FD Backend Health Window Size", + "description": "Window size for the alert" + } + }, + "FDBackendHealthEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "FD Backend Health Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "FDBackendHealthPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "FD Backend Health Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "FDBackendHealthAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "FD Backend Health Alert State", + "description": "Alert state for the alert" + } + }, + "FDBackendRequestLatencyAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "FD Backend Request Latency Alert Severity", + "description": "Severity of the alert" + } + }, + "FDBackendRequestLatencyWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "FD Backend Request Latency Window Size", + "description": "Window size for the alert" + } + }, + "FDBackendRequestLatencyEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "FD Backend Request Latency Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "FDBackendRequestLatencyPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "FD Backend Request Latency Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "FDBackendRequestLatencyAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "FD Backend Request Latency Alert State", + "description": "Alert state for the alert" + } + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "ALZ_KVRequest", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_KeyVault_Requests_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('KVRequestAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('KVRequestWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('KVRequestEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('KVRequestPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('KVRequestAlertState')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_KvAvailability", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_KeyVault_Availability_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('KvAvailabilityAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('KvAvailabilityWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('KvAvailabilityEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('KvAvailabilityPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('KvAvailabilityAlertState')]" + }, + "threshold": { + "value": "[[[parameters('KVAvailabilityThreshold')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_KvLatencyAvailability", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_KeyVault_Latency_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('KvLatencyAvailabilityAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('KvLatencyAvailabilityWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('KvLatencyAvailabilityEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('KvLatencyAvailabilityPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('KvLatencyAvailabilityAlertState')]" + }, + "threshold": { + "value": "[[[parameters('KvLatencyAvailabilityThreshold')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_KVCapacity", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_KeyVault_Capacity_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('KVCapacityAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('KVCapacityWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('KVCapacityEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('KVCapacityPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('KVCapacityAlertState')]" + }, + "threshold": { + "value": "[[[parameters('KVCapacityThreshold')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_activityKVDelete", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_KeyVault_Delete", + "parameters": { + "enabled": { + "value": "[[[parameters('activityKVDeleteAlertState')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_StorageAccountAvailability", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_StorageAccount_Availability_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('StorageAccountAvailabilityAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('StorageAccountAvailabilityWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('StorageAccountAvailabilityFrequency')]" + }, + "effect": { + "value": "[[[parameters('StorageAccountAvailabilityPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('StorageAccountAvailabilityAlertState')]" + }, + "threshold": { + "value": "[[[parameters('StorageAccountAvailabilityThreshold')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_activitySADelete", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_StorageAccount_Delete", + "parameters": { + "effect": { + "value": "[[[parameters('StorageAccountDeletePolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('StorageAccountDeleteAlertState')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_PIPBytesInDDoS", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_PublicIp_BytesInDDoSAttack_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('PIPBytesInDDoSAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('PIPBytesInDDoSWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('PIPBytesInDDoSEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('PIPBytesInDDoSPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('PIPBytesInDDoSAlertState')]" + }, + "threshold": { + "value": "[[[parameters('PIPBytesInDDoSThreshold')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_PIPDDoSAttack", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_PublicIp_DDoSAttack_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('PIPDDoSAttackAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('PIPDDoSAttackWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('PIPDDoSAttackEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('PIPDDoSAttackPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('PIPDDoSAttackAlertState')]" + }, + "threshold": { + "value": "[[[parameters('PIPDDoSAttackThreshold')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_PIPPacketsInDDoS", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_PublicIp_PacketsInDDoSAttack_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('PIPPacketsInDDoSAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('PIPPacketsInDDoSWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('PIPPacketsInDDoSEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('PIPPacketsInDDoSPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('PIPPacketsInDDoSAlertState')]" + }, + "threshold": { + "value": "[[[parameters('PIPPacketsInDDoSThreshold')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_PIPVIPAvailability", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_PublicIp_VIPAvailability_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('PIPVIPAvailabilityAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('PIPVIPAvailabilityWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('PIPVIPAvailabilityEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('PIPVIPAvailabilityPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('PIPVIPAvailabilityAlertState')]" + }, + "threshold": { + "value": "[[[parameters('PIPVIPAvailabilityThreshold')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_activityNSGDelete", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_NSG_Delete", + "parameters": { + "enabled": { + "value": "[[[parameters('activityNSGDeleteAlertState')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_activityUDRUpdate", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_RouteTable_Update", + "parameters": { + "enabled": { + "value": "[[[parameters('activityUDRUpdateAlertState')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_RVBackupHealthMonitor", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_RecoveryVault_BackupHealthMonitor_Alert", + "parameters": { + "effect": { + "value": "[[[parameters('RVBackupHealthMonitorPolicyEffect')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VNETDDOSAttack", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VNET_DDoSAttack_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('VNETDDOSAttackAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('VNETDDOSAttackWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('VNETDDOSAttackEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('VNETDDOSAttackPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('VNETDDOSAttackAlertState')]" + }, + "threshold": { + "value": "[[[parameters('VNETDDOSAttackThreshold')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VMHeartBeatRG", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VM_HeartBeat_Alert", + "parameters": { + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "severity": { + "value": "[[[parameters('VMHeartBeatRGAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('VMHeartBeatRGWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('VMHeartBeatRGEvaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[[parameters('VMHeartBeatRGAutoMitigate')]" + }, + "autoResolve": { + "value": "[[[parameters('VMHeartBeatRGAutoResolve')]" + }, + "autoResolveTime": { + "value": "[[[parameters('VMHeartBeatRGAutoResolveTime')]" + }, + "effect": { + "value": "[[[parameters('VMHeartBeatRGPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('VMHeartBeatRGAlertState')]" + }, + "threshold": { + "value": "[[[parameters('VMHeartBeatRGThreshold')]" + }, + "operator": { + "value": "[[[parameters('VMHeartBeatRGOperator')]" + }, + "timeAggregation": { + "value": "[[[parameters('VMHeartBeatRGTimeAggregation')]" + }, + "failingPeriods": { + "value": "[[[parameters('VMHeartBeatRGFailingPeriods')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VMNetworkIn", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VM_NetworkIn_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('VMNetworkInAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('VMNetworkInWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('VMNetworkInEvaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[[parameters('VMNetworkInAutoMitigate')]" + }, + "autoResolve": { + "value": "[[[parameters('VMNetworkInAutoResolve')]" + }, + "autoResolveTime": { + "value": "[[[parameters('VMNetworkInAutoResolveTime')]" + }, + "effect": { + "value": "[[[parameters('VMNetworkInPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('VMNetworkInAlertState')]" + }, + "threshold": { + "value": "[[[parameters('VMNetworkInThreshold')]" + }, + "operator": { + "value": "[[[parameters('VMNetworkInOperator')]" + }, + "timeAggregation": { + "value": "[[[parameters('VMNetworkInTimeAggregation')]" + }, + "failingPeriods": { + "value": "[[[parameters('VMNetworkInFailingPeriods')]" + }, + "evaluationPeriods": { + "value": "[[[parameters('VMNetworkInEvaluationPeriods')]" + }, + "computersToInclude": { + "value": "[[[parameters('VMNetworkInComputersToInclude')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VMNetworkOut", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VM_NetworkOut_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('VMNetworkOutAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('VMNetworkOutWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('VMNetworkOutEvaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[[parameters('VMNetworkOutAutoMitigate')]" + }, + "autoResolve": { + "value": "[[[parameters('VMNetworkOutAutoResolve')]" + }, + "autoResolveTime": { + "value": "[[[parameters('VMNetworkOutAutoResolveTime')]" + }, + "effect": { + "value": "[[[parameters('VMNetworkOutPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('VMNetworkOutAlertState')]" + }, + "threshold": { + "value": "[[[parameters('VMNetworkOutThreshold')]" + }, + "operator": { + "value": "[[[parameters('VMNetworkOutOperator')]" + }, + "timeAggregation": { + "value": "[[[parameters('VMNetworkOutTimeAggregation')]" + }, + "failingPeriods": { + "value": "[[[parameters('VMNetworkOutFailingPeriods')]" + }, + "evaluationPeriods": { + "value": "[[[parameters('VMNetworkOutEvaluationPeriods')]" + }, + "computersToInclude": { + "value": "[[[parameters('VMNetworkOutComputersToInclude')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VMOSDiskReadLatency", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VM_OSDiskreadLatency_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('VMOSDiskReadLatencyAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('VMOSDiskReadLatencyWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('VMOSDiskReadLatencyEvaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[[parameters('VMOSDiskReadLatencyAutoMitigate')]" + }, + "autoResolve": { + "value": "[[[parameters('VMOSDiskReadLatencyAutoResolve')]" + }, + "autoResolveTime": { + "value": "[[[parameters('VMOSDiskReadLatencyAutoResolveTime')]" + }, + "effect": { + "value": "[[[parameters('VMOSDiskReadLatencyPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('VMOSDiskReadLatencyAlertState')]" + }, + "threshold": { + "value": "[[[parameters('VMOSDiskReadLatencyThreshold')]" + }, + "operator": { + "value": "[[[parameters('VMOSDiskReadLatencyOperator')]" + }, + "timeAggregation": { + "value": "[[[parameters('VMOSDiskReadLatencyTimeAggregation')]" + }, + "failingPeriods": { + "value": "[[[parameters('VMOSDiskReadLatencyFailingPeriods')]" + }, + "evaluationPeriods": { + "value": "[[[parameters('VMOSDiskReadLatencyEvaluationPeriods')]" + }, + "computersToInclude": { + "value": "[[[parameters('VMOSDiskReadLatencyComputersToInclude')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VMOSDiskWriteLatency", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VM_OSDiskwriteLatency_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('VMOSDiskWriteLatencyAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('VMOSDiskWriteLatencyWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('VMOSDiskWriteLatencyEvaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[[parameters('VMOSDiskWriteLatencyAutoMitigate')]" + }, + "autoResolve": { + "value": "[[[parameters('VMOSDiskWriteLatencyAutoResolve')]" + }, + "autoResolveTime": { + "value": "[[[parameters('VMOSDiskWriteLatencyAutoResolveTime')]" + }, + "effect": { + "value": "[[[parameters('VMOSDiskWriteLatencyPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('VMOSDiskWriteLatencyAlertState')]" + }, + "threshold": { + "value": "[[[parameters('VMOSDiskWriteLatencyThreshold')]" + }, + "operator": { + "value": "[[[parameters('VMOSDiskWriteLatencyOperator')]" + }, + "timeAggregation": { + "value": "[[[parameters('VMOSDiskWriteLatencyTimeAggregation')]" + }, + "failingPeriods": { + "value": "[[[parameters('VMOSDiskWriteLatencyFailingPeriods')]" + }, + "evaluationPeriods": { + "value": "[[[parameters('VMOSDiskWriteLatencyEvaluationPeriods')]" + }, + "computersToInclude": { + "value": "[[[parameters('VMOSDiskWriteLatencyComputersToInclude')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VMOSDiskSpace", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VM_OSDiskSpace_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('VMOSDiskSpaceAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('VMOSDiskSpaceWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('VMOSDiskSpaceEvaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[[parameters('VMOSDiskSpaceAutoMitigate')]" + }, + "autoResolve": { + "value": "[[[parameters('VMOSDiskSpaceAutoResolve')]" + }, + "autoResolveTime": { + "value": "[[[parameters('VMOSDiskSpaceAutoResolveTime')]" + }, + "effect": { + "value": "[[[parameters('VMOSDiskSpacePolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('VMOSDiskSpaceAlertState')]" + }, + "threshold": { + "value": "[[[parameters('VMOSDiskSpaceThreshold')]" + }, + "operator": { + "value": "[[[parameters('VMOSDiskSpaceOperator')]" + }, + "timeAggregation": { + "value": "[[[parameters('VMOSDiskSpaceTimeAggregation')]" + }, + "failingPeriods": { + "value": "[[[parameters('VMOSDiskSpaceFailingPeriods')]" + }, + "evaluationPeriods": { + "value": "[[[parameters('VMOSDiskSpaceEvaluationPeriods')]" + }, + "computersToInclude": { + "value": "[[[parameters('VMOSDiskSpaceComputersToInclude')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VMPercentCPU", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VM_CPU_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('VMPercentCPUAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('VMPercentCPUWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('VMPercentCPUEvaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[[parameters('VMPercentCPUAutoMitigate')]" + }, + "autoResolve": { + "value": "[[[parameters('VMPercentCPUAutoResolve')]" + }, + "autoResolveTime": { + "value": "[[[parameters('VMPercentCPUAutoResolveTime')]" + }, + "effect": { + "value": "[[[parameters('VMPercentCPUPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('VMPercentCPUAlertState')]" + }, + "threshold": { + "value": "[[[parameters('VMPercentCPUThreshold')]" + }, + "operator": { + "value": "[[[parameters('VMPercentCPUOperator')]" + }, + "timeAggregation": { + "value": "[[[parameters('VMPercentCPUTimeAggregation')]" + }, + "failingPeriods": { + "value": "[[[parameters('VMPercentCPUFailingPeriods')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VMPercentMemory", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VM_Memory_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('VMPercentMemoryAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('VMPercentMemoryWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('VMPercentMemoryEvaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[[parameters('VMPercentMemoryAutoMitigate')]" + }, + "autoResolve": { + "value": "[[[parameters('VMPercentMemoryAutoResolve')]" + }, + "autoResolveTime": { + "value": "[[[parameters('VMPercentMemoryAutoResolveTime')]" + }, + "effect": { + "value": "[[[parameters('VMPercentMemoryPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('VMPercentMemoryAlertState')]" + }, + "threshold": { + "value": "[[[parameters('VMPercentMemoryThreshold')]" + }, + "operator": { + "value": "[[[parameters('VMPercentMemoryOperator')]" + }, + "timeAggregation": { + "value": "[[[parameters('VMPercentMemoryTimeAggregation')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VMDataDiskSpace", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VM_dataDiskSpace_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('VMDataDiskSpaceAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('VMDataDiskSpaceWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('VMDataDiskSpaceEvaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[[parameters('VMDataDiskSpaceAutoMitigate')]" + }, + "autoResolve": { + "value": "[[[parameters('VMDataDiskSpaceAutoResolve')]" + }, + "autoResolveTime": { + "value": "[[[parameters('VMDataDiskSpaceAutoResolveTime')]" + }, + "effect": { + "value": "[[[parameters('VMDataDiskSpacePolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('VMDataDiskSpaceAlertState')]" + }, + "threshold": { + "value": "[[[parameters('VMDataDiskSpaceThreshold')]" + }, + "operator": { + "value": "[[[parameters('VMDataDiskSpaceOperator')]" + }, + "timeAggregation": { + "value": "[[[parameters('VMDataDiskSpaceTimeAggregation')]" + }, + "failingPeriods": { + "value": "[[[parameters('VMDataDiskSpaceFailingPeriods')]" + }, + "evaluationPeriods": { + "value": "[[[parameters('VMDataDiskSpaceEvaluationPeriods')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VMDataDiskReadLatency", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VM_dataDiskReadLatency_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('VMDataDiskReadLatencyAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('VMDataDiskReadLatencyWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('VMDataDiskReadLatencyEvaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[[parameters('VMDataDiskReadLatencyAutoMitigate')]" + }, + "autoResolve": { + "value": "[[[parameters('VMDataDiskReadLatencyAutoResolve')]" + }, + "autoResolveTime": { + "value": "[[[parameters('VMDataDiskReadLatencyAutoResolveTime')]" + }, + "effect": { + "value": "[[[parameters('VMDataDiskReadLatencyPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('VMDataDiskReadLatencyAlertState')]" + }, + "threshold": { + "value": "[[[parameters('VMDataDiskReadLatencyThreshold')]" + }, + "operator": { + "value": "[[[parameters('VMDataDiskReadLatencyOperator')]" + }, + "timeAggregation": { + "value": "[[[parameters('VMDataDiskReadLatencyTimeAggregation')]" + }, + "failingPeriods": { + "value": "[[[parameters('VMDataDiskReadLatencyFailingPeriods')]" + }, + "evaluationPeriods": { + "value": "[[[parameters('VMDataDiskReadLatencyEvaluationPeriods')]" + }, + "computersToInclude": { + "value": "[[[parameters('VMDataDiskReadLatencyComputersToInclude')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VMDataDiskWriteLatency", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VM_dataDiskWriteLatency_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('VMDataDiskWriteLatencyAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('VMDataDiskWriteLatencyWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('VMDataDiskWriteLatencyEvaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[[parameters('VMDataDiskWriteLatencyAutoMitigate')]" + }, + "autoResolve": { + "value": "[[[parameters('VMDataDiskWriteLatencyAutoResolve')]" + }, + "autoResolveTime": { + "value": "[[[parameters('VMDataDiskWriteLatencyAutoResolveTime')]" + }, + "effect": { + "value": "[[[parameters('VMDataDiskWriteLatencyPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('VMDataDiskWriteLatencyAlertState')]" + }, + "threshold": { + "value": "[[[parameters('VMDataDiskWriteLatencyThreshold')]" + }, + "operator": { + "value": "[[[parameters('VMDataDiskWriteLatencyOperator')]" + }, + "timeAggregation": { + "value": "[[[parameters('VMDataDiskWriteLatencyTimeAggregation')]" + }, + "failingPeriods": { + "value": "[[[parameters('VMDataDiskWriteLatencyFailingPeriods')]" + }, + "evaluationPeriods": { + "value": "[[[parameters('VMDataDiskWriteLatencyEvaluationPeriods')]" + }, + "computersToInclude": { + "value": "[[[parameters('VMDataDiskWriteLatencyComputersToInclude')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_AGWTotalTime", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_AG_ApplicationGatewayTotalTime_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('AGWApplicationGatewayTotalTimeAlertSeverity')]" + }, + "alertSensitivity": { + "value": "[[[parameters('AGWApplicationGatewayTotalTimeAlertSensitivity')]" + }, + "windowSize": { + "value": "[[[parameters('AGWApplicationGatewayTotalTimeWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('AGWApplicationGatewayTotalTimeEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('AGWApplicationGatewayTotalTimePolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('AGWApplicationGatewayTotalTimeAlertState')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_AGWBackendLastByteResponseTime", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_AG_BackendLastByteResponseTime_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('AGWBackendLastByteResponseTimeAlertSeverity')]" + }, + "alertSensitivity": { + "value": "[[[parameters('AGWBackendLastByteResponseTimeAlertSensitivity')]" + }, + "windowSize": { + "value": "[[[parameters('AGWBackendLastByteResponseTimeWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('AGWBackendLastByteResponseTimeEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('AGWBackendLastByteResponseTimePolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('AGWBackendLastByteResponseTimeAlertState')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_AGWCapacityUnits", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_AG_CapacityUnits_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('AGWCapacityUnitsAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('AGWCapacityUnitsWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('AGWCapacityUnitsEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('AGWCapacityUnitsPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('AGWCapacityUnitsAlertState')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_AGWComputeUnits", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_AG_ComputeUnits_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('AGWComputeUnitsAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('AGWComputeUnitsWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('AGWComputeUnitsEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('AGWComputeUnitsPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('AGWComputeUnitsAlertState')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_AGWCPUUtilization", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_AG_CPUUtilization_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('AGWCPUUtilAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('AGWCPUUtilWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('AGWCPUUtilEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('AGWCPUUtilPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('AGWCPUUtilAlertState')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_AGWFailedRequests", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_AG_FailedRequests_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('AGWFailedRequestsAlertSeverity')]" + }, + "alertSensitivity": { + "value": "[[[parameters('AGWFailedRequestsAlertSensitivity')]" + }, + "windowSize": { + "value": "[[[parameters('AGWFailedRequestsWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('AGWFailedRequestsEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('AGWFailedRequestsPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('AGWFailedRequestsAlertState')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_AGWResponseStatus", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_AG_ResponseStatus_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('AGWResponseStatusAlertSeverity')]" + }, + "alertSensitivity": { + "value": "[[[parameters('AGWResponseStatusAlertSensitivity')]" + }, + "windowSize": { + "value": "[[[parameters('AGWResponseStatusWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('AGWResponseStatusEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('AGWResponseStatusPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('AGWResponseStatusAlertState')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_AGWUnhealthyHostCount", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_AG_UnhealthyHostCount_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('AGWUnhealthyHostCountAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('AGWUnhealthyHostCountWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('AGWUnhealthyHostCountEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('AGWUnhealthyHostCountPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('AGWUnhealthyHostCountAlertState')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_LBDataPathAvailability", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ALB_DataPathAvailability_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('LBDataPathAvailabilityAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('LBDataPathAvailabilityWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('LBDataPathAvailabilityEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('LBDataPathAvailabilityPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('LBDataPathAvailabilityAlertState')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_LBGlobalBackendAvailability", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ALB_GlobalBackendAvailability_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('LBGlobalBackendAvailabilityAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('LBGlobalBackendAvailabilityWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('LBGlobalBackendAvailabilityEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('LBGlobalBackendAvailabilityPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('LBGlobalBackendAvailabilityAlertState')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_LBHealthProbeStatus", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ALB_HealthProbeStatus_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('LBHealthProbeStatusAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('LBHealthProbeStatusWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('LBHealthProbeStatusEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('LBHealthProbeStatusPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('LBHealthProbeStatusAlertState')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_LBUsedSNATPorts", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ALB_UsedSNATPorts_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('LBUsedSNATPortsAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('LBUsedSNATPortsWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('LBUsedSNATPortsEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('LBUsedSNATPortsPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('LBUsedSNATPortsAlertState')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_CDNPOriginHealthPercentage", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_FrontDoorCDN_OriginHealthPercentage_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('CDNPOriginHealthPercentageAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('CDNPOriginHealthPercentageWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('CDNPOriginHealthPercentageEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('CDNPOriginHealthPercentagePolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('CDNPOriginHealthPercentageAlertState')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_CDNPOriginLatency", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_FrontDoorCDN_OriginLatency_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('CDNPOriginLatencyAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('CDNPOriginLatencyWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('CDNPOriginLatencyEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('CDNPOriginLatencyPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('CDNPOriginLatencyAlertState')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_CDNPPercentage4XX", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_FrontDoorCDN_Percentage4XX_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('CDNPPercentage4XXAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('CDNPPercentage4XXWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('CDNPPercentage4XXEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('CDNPPercentage4XXPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('CDNPPercentage4XXAlertState')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_CDNPPercentage5XX", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_FrontDoorCDN_Percentage5XX_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('CDNPPercentage5XXAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('CDNPPercentage5XXWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('CDNPPercentage5XXEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('CDNPPercentage5XXPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('CDNPPercentage5XXAlertState')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_TMEndpointHealth", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_TM_EndpointHealth_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('TMEndpointHealthAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('TMEndpointHealthWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('TMEndpointHealthEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('TMEndpointHealthPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('TMEndpointHealthAlertState')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_WSFCPUPercentage", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_WSF_CPUPercentage_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('WSFCPUPercentageAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('WSFCPUPercentageWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('WSFCPUPercentageEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('WSFCPUPercentagePolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('WSFCPUPercentageAlertState')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_WSFMemoryPercentage", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_WSF_MemoryPercentage_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('WSFMemoryPercentageAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('WSFMemoryPercentageWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('WSFMemoryPercentageEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('WSFMemoryPercentagePolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('WSFMemoryPercentageAlertState')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_WSFDiskQueueLength", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_WSF_DiskQueueLength_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('WSFDiskQueueLengthAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('WSFDiskQueueLengthWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('WSFDiskQueueLengthEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('WSFDiskQueueLengthPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('WSFDiskQueueLengthAlertState')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_WSFHttpQueueLength", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_WSF_HttpQueueLength_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('WSFHttpQueueLengthAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('WSFHttpQueueLengthWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('WSFHttpQueueLengthEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('WSFHttpQueueLengthPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('WSFHttpQueueLengthAlertState')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_FDBackendHealth", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_FD_BackendHealth_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('FDBackendHealthAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('FDBackendHealthWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('FDBackendHealthEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('FDBackendHealthPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('FDBackendHealthAlertState')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_FDBackendRequestLatency", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_FD_BackendRequestLatency_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('FDBackendRequestLatencyAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('FDBackendRequestLatencyWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('FDBackendRequestLatencyEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('FDBackendRequestLatencyPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('FDBackendRequestLatencyAlertState')]" + } + } + } + ], + "policyType": "Custom", + "policyDefinitionGroups": null + } + }, + "$fxv#1": { + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "name": "Alerting-Management", + "properties": { + "displayName": "Deploy Azure Monitor Baseline Alerts for Management", + "description": "Initiative to deploy AMBA alerts relevant to the ALZ Management management group", + "metadata": { + "version": "1.2.0", + "category": "Monitoring", + "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", + "alzCloudEnvironments": [ + "AzureCloud" + ], + "_deployed_by_amba": true + }, + "parameters": { + "ALZMonitorResourceGroupName": { + "type": "String", + "defaultValue": "ALZ-Monitoring-RG", + "metadata": { + "displayName": "ALZ Monitoring Resource Group Name", + "description": "Name of the resource group to deploy the ALZ monitoring resources to" + } + }, + "ALZMonitorResourceGroupTags": { + "type": "Object", + "defaultValue": { + "_deployed_by_alz_monitor": true + }, + "metadata": { + "displayName": "ALZ Monitoring Resource Group Tags", + "description": "Tags to apply to the resource group" + } + }, + "ALZMonitorResourceGroupLocation": { + "type": "String", + "defaultValue": "centralus", + "metadata": { + "displayName": "ALZ Monitoring Resource Group Location", + "description": "Location of the resource group" + } + }, + "ALZMonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": "MonitorDisable" + }, + "ALZMonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] + }, + "ALZUserAssignedManagedIdentityName": { + "type": "string", + "defaultValue": "id-AMBA-ARG-Reader-001", + "metadata": { + "description": "The name of the user assigned managed identity to be created for monitoring purpose.", + "displayName": "Name of the user assigned managed identity to be created." + } + }, + "ALZManagementSubscriptionId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "The subscription ID of the management subscription where the user assigned managed identity will be created." + } + }, + "BYOUserAssignedManagedIdentityResourceId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "The resource Id of the user assigned managed identity provided by the customer.", + "displayName": "Customer defined User Assigned managed Identity resource Id." + } + }, + "AATotalJobAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "AA Total Job Alert Severity", + "description": "Severity of the alert" + } + }, + "AATotalJobAlertWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "AA Total Job Alert Window Size", + "description": "Window size for the alert" + } + }, + "AATotalJobAlertEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "AA Total Job Alert Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "AATotalJobAlertPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "AA Total Job Alert Policy Effect", + "description": "Policy effect for the alert" + } + }, + "AATotalJobAlertAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "AA Total Job Alert State", + "description": "Alert state for the alert" + } + }, + "AATotalJobAlertThreshold": { + "type": "string", + "defaultValue": "20", + "metadata": { + "displayName": "AA Total Job Alert Threshold", + "description": "Threshold for the alert" + } + }, + "RVBackupHealthMonitorPolicyEffect": { + "type": "string", + "defaultValue": "modify", + "allowedValues": [ + "modify", + "audit", + "disabled" + ], + "metadata": { + "displayName": "RV Backup Health Monitor Policy Effect", + "description": "Policy effect for the alert, modify will create the alert if it does not exist and enable it on your Recovery Vaults, audit will only audit if alerting is enabled on Recovery Vaults, disabled will not create the alert on Recovery Vaults" + } + }, + "StorageAccountAvailabilityAlertSeverity": { + "type": "String", + "defaultValue": "1", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "Storage Account Availability Alert Severity", + "description": "Severity of the alert" + } + }, + "StorageAccountAvailabilityWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "Storage Account Availability Alert Window Size", + "description": "Window size for the alert" + } + }, + "StorageAccountAvailabilityFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "Storage Account Availability Alert Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "StorageAccountAvailabilityPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Storage Account Availability Alert Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will create the alert if it does not exist, disabled will not create the alert" + } + }, + "StorageAccountAvailabilityAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Storage Account Availability Alert State", + "description": "Alert state for the alert" + } + }, + "StorageAccountAvailabilityThreshold": { + "type": "string", + "defaultValue": "90", + "metadata": { + "displayName": "Storage Account Availability Alert Threshold", + "description": "Threshold for the alert" + } + }, + "StorageAccountDeletePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Storage Account Delete Alert Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will create the alert if it does not exist, disabled will not create the alert" + } + }, + "StorageAccountDeleteAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Storage Account Delete Alert State", + "description": "Alert state for the alert" + } + }, + "activityLAWDeletePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Activity Log Alert Delete Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will create the alert if it does not exist, disabled will not create the alert" + } + }, + "activityLAWDeleteAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Activity Log Alert Delete Alert State", + "description": "Alert state for the alert" + } + }, + "activityLAWKeyRegenPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "LAW Key Regen Alert Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will create the alert if it does not exist, disabled will not create the alert" + } + }, + "activityLAWKeyRegenAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Activity Log Alert Key Regen Alert State", + "description": "Alert state for the alert" + } + }, + "LAWDailyCapLimitSeverity": { + "type": "String", + "metadata": { + "displayName": "Log Analytics Workspace Daily Cap Limit Reached Alert Severity", + "description": "Severity of the Alert" + }, + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "defaultValue": "2" + }, + "LAWDailyCapLimitOperator": { + "type": "String", + "metadata": { + "displayName": "Log Analytics Workspace Daily Cap Limit Reached Alert Operator" + }, + "allowedValues": [ + "GreaterThan", + "GreaterThanOrEqual" + ], + "defaultValue": "GreaterThan" + }, + "LAWDailyCapLimitTimeAggregation": { + "type": "String", + "metadata": { + "displayName": "Log Analytics Workspace Daily Cap Limit Reached Alert TimeAggregation" + }, + "allowedValues": [ + "Count" + ], + "defaultValue": "Count" + }, + "LAWDailyCapLimitWindowSize": { + "type": "String", + "metadata": { + "displayName": "Log Analytics Workspace Daily Cap Limit Reached Alert Window Size", + "description": "Window size for the alert" + }, + "allowedValues": [ + "PT1M", + "PT5M", + "PT10M", + "PT15M", + "PT30M", + "PT45M", + "PT1H", + "PT2H", + "PT3H", + "PT4H", + "PT5H", + "PT6H", + "P1D" + ], + "defaultValue": "P1D" + }, + "LAWDailyCapLimitEvaluationFrequency": { + "type": "String", + "metadata": { + "displayName": "Log Analytics Workspace Daily Cap Limit Reached Alert Evaluation Frequency", + "description": "Evaluation frequency for the alert" + }, + "allowedValues": [ + "PT5M", + "PT10M", + "PT15M", + "PT30M", + "PT45M", + "PT1H", + "PT2H", + "PT3H", + "PT4H", + "PT5H", + "PT6H", + "P1D" + ], + "defaultValue": "PT1H" + }, + "LAWDailyCapLimitAutoMitigate": { + "type": "String", + "metadata": { + "displayName": "Log Analytics Workspace Daily Cap Limit Reached Alert Auto Mitigate", + "description": "Auto Mitigate for the alert" + }, + "allowedValues": [ + "true", + "false" + ], + "defaultValue": "true" + }, + "LAWDailyCapLimitThreshold": { + "type": "String", + "metadata": { + "displayName": "Log Analytics Workspace Daily Cap Limit Reached Alert Threshold", + "description": "Threshold for the alert" + }, + "defaultValue": "0" + }, + "LAWDailyCapLimitFailingPeriods": { + "type": "String", + "metadata": { + "displayName": "Log Analytics Workspace Daily Cap Limit Reached Alert Failing Periods", + "description": "Number of failing periods before alert is fired" + }, + "defaultValue": "1" + }, + "LAWDailyCapLimitEvaluationPeriods": { + "type": "String", + "metadata": { + "displayName": "Log Analytics Workspace Daily Cap Limit Reached Alert Evaluation Periods", + "description": "The number of aggregated lookback points." + }, + "defaultValue": "1" + }, + "LAWDailyCapLimitPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Log Analytics Workspace Daily Cap Limit Reached Alert Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will create the alert if it does not exist, disabled will not create the alert" + } + }, + "LAWDailyCapLimitAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "ALog Analytics Workspace Daily Cap Limit Reached Alert State", + "description": "Alert state for the alert" + } + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "ALZ_activityLAWDelete", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_LAWorkspace_Delete", + "parameters": { + "effect": { + "value": "[[[parameters('activityLAWDeletePolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('activityLAWDeleteAlertState')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_activityLAWKeyRegen", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_LAWorkspace_KeyRegen", + "parameters": { + "effect": { + "value": "[[[parameters('activityLAWKeyRegenPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('activityLAWKeyRegenAlertState')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_LAWorkspaceDailyCapLimitReached", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_LAWorkspace_DailyCapLimitReached_Alert", + "parameters": { + "UAMIResourceId": { + "value": "[[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), concat('/subscriptions/', parameters('ALZManagementSubscriptionId'), '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('ALZUserAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" + }, + "severity": { + "value": "[[[parameters('LAWDailyCapLimitSeverity')]" + }, + "operator": { + "value": "[[[parameters('LAWDailyCapLimitOperator')]" + }, + "timeAggregation": { + "value": "[[[parameters('LAWDailyCapLimitTimeAggregation')]" + }, + "windowSize": { + "value": "[[[parameters('LAWDailyCapLimitWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('LAWDailyCapLimitEvaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[[parameters('LAWDailyCapLimitAutoMitigate')]" + }, + "threshold": { + "value": "[[[parameters('LAWDailyCapLimitThreshold')]" + }, + "failingPeriods": { + "value": "[[[parameters('LAWDailyCapLimitFailingPeriods')]" + }, + "evaluationPeriods": { + "value": "[[[parameters('LAWDailyCapLimitEvaluationPeriods')]" + }, + "effect": { + "value": "[[[parameters('LAWDailyCapLimitPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('LAWDailyCapLimitAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_AATotalJob", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_AA_TotalJob_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('AATotalJobAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('AATotalJobAlertWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('AATotalJobAlertEvaluationFrequency')]" + }, + "effect": { + "value": "[[[parameters('AATotalJobAlertPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('AATotalJobAlertAlertState')]" + }, + "threshold": { + "value": "[[[parameters('AATotalJobAlertThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_RVBackupHealth", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_RecoveryVault_BackupHealthMonitor_Alert", + "parameters": { + "effect": { + "value": "[[[parameters('RVBackupHealthMonitorPolicyEffect')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_StorageAccountAvailability", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_StorageAccount_Availability_Alert", + "parameters": { + "severity": { + "value": "[[[parameters('StorageAccountAvailabilityAlertSeverity')]" + }, + "windowSize": { + "value": "[[[parameters('StorageAccountAvailabilityWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[[parameters('StorageAccountAvailabilityFrequency')]" + }, + "effect": { + "value": "[[[parameters('StorageAccountAvailabilityPolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('StorageAccountAvailabilityAlertState')]" + }, + "threshold": { + "value": "[[[parameters('StorageAccountAvailabilityThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_activitySADelete", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_StorageAccount_Delete", + "parameters": { + "effect": { + "value": "[[[parameters('StorageAccountDeletePolicyEffect')]" + }, + "enabled": { + "value": "[[[parameters('StorageAccountDeleteAlertState')]" + }, + "alertResourceGroupName": { + "value": "[[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[[parameters('ALZMonitorDisableTagValues')]" + } + } + } + ], + "policyType": "Custom", + "policyDefinitionGroups": null + } + }, + "cloudEnv": "[environment().name]", + "defaultDeploymentLocationByCloudType": { + "AzureCloud": "northeurope", + "AzureChinaCloud": "chinaeast2", + "AzureUSGovernment": "usgovvirginia" + }, + "templateVars": { + "scope": "/providers/Microsoft.Management/managementGroups/contoso", + "defaultDeploymentLocation": "\"location\": \"northeurope\"", + "localizedDeploymentLocation": "[format('\"location\": \"{0}\"', variables('defaultDeploymentLocationByCloudType')[variables('cloudEnv')])]" + }, + "targetDeploymentLocationByCloudType": { + "AzureCloud": "[coalesce(parameters('location'), 'northeurope')]", + "AzureChinaCloud": "[coalesce(parameters('location'), 'chinaeast2')]", + "AzureUSGovernment": "[coalesce(parameters('location'), 'usgovvirginia')]" + }, + "deploymentLocation": "[format('\"location\": \"{0}\"', variables('targetDeploymentLocationByCloudType')[variables('cloudEnv')])]", + "loadPolicyDefinitions": { + "All": [], + "AzureCloud": [], + "AzureChinaCloud": [], + "AzureUSGovernment": [] + }, + "loadPolicySetDefinitions": { + "All": [ + "[string(variables('$fxv#0'))]", + "[string(variables('$fxv#1'))]" + ], + "AzureCloud": [], + "AzureChinaCloud": [], + "AzureUSGovernment": [] + }, + "policyDefinitionsByCloudType": { + "All": "[variables('policyDefinitionsAll')]", + "AzureCloud": "[variables('policyDefinitionsAzureCloud')]", + "AzureChinaCloud": "[variables('policyDefinitionsAzureChinaCloud')]", + "AzureUSGovernment": "[variables('policyDefinitionsAzureUSGovernment')]" + }, + "policySetDefinitionsByCloudType": { + "All": "[variables('policySetDefinitionsAll')]", + "AzureCloud": "[variables('policySetDefinitionsAzureCloud')]", + "AzureChinaCloud": "[variables('policySetDefinitionsAzureChinaCloud')]", + "AzureUSGovernment": "[variables('policySetDefinitionsAzureUSGovernment')]" + }, + "policyDefinitions": "[concat(variables('policyDefinitionsByCloudType').All, variables('policyDefinitionsByCloudType')[variables('cloudEnv')])]", + "policySetDefinitions": "[concat(variables('policySetDefinitionsByCloudType').All, variables('policySetDefinitionsByCloudType')[variables('cloudEnv')])]" + }, + "resources": [ + { + "copy": { + "name": "PolicyDefinitions", + "count": "[length(variables('policyDefinitions'))]" + }, + "type": "Microsoft.Authorization/policyDefinitions", + "apiVersion": "2020-09-01", + "name": "[variables('policyDefinitions')[copyIndex()].name]", + "properties": { + "description": "[variables('policyDefinitions')[copyIndex()].properties.description]", + "displayName": "[variables('policyDefinitions')[copyIndex()].properties.displayName]", + "metadata": "[variables('policyDefinitions')[copyIndex()].properties.metadata]", + "mode": "[variables('policyDefinitions')[copyIndex()].properties.mode]", + "parameters": "[variables('policyDefinitions')[copyIndex()].properties.parameters]", + "policyType": "[variables('policyDefinitions')[copyIndex()].properties.policyType]", + "policyRule": "[variables('policyDefinitions')[copyIndex()].properties.policyRule]" + } + }, + { + "copy": { + "name": "PolicySetDefinitions", + "count": "[length(variables('policySetDefinitions'))]" + }, + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2020-09-01", + "name": "[variables('policySetDefinitions')[copyIndex()].name]", + "properties": { + "description": "[variables('policySetDefinitions')[copyIndex()].properties.description]", + "displayName": "[variables('policySetDefinitions')[copyIndex()].properties.displayName]", + "metadata": "[variables('policySetDefinitions')[copyIndex()].properties.metadata]", + "parameters": "[variables('policySetDefinitions')[copyIndex()].properties.parameters]", + "policyType": "[variables('policySetDefinitions')[copyIndex()].properties.policyType]", + "policyDefinitions": "[variables('policySetDefinitions')[copyIndex()].properties.policyDefinitions]", + "policyDefinitionGroups": "[variables('policySetDefinitions')[copyIndex()].properties.policyDefinitionGroups]" + }, + "dependsOn": [ + "PolicyDefinitions" + ] + } + ], + "outputs": { + "policyDefinitionNames": { + "type": "array", + "copy": { + "count": "[length(variables('policyDefinitions'))]", + "input": "[variables('policyDefinitions')[copyIndex()].name]" + } + }, + "policySetDefinitionNames": { + "type": "array", + "copy": { + "count": "[length(variables('policySetDefinitions'))]", + "input": "[variables('policySetDefinitions')[copyIndex()].name]" + } + } + } +} \ No newline at end of file diff --git a/patterns/alz/policySetDefinitions/Deploy-Connectivity-Alerts.json b/patterns/alz/policySetDefinitions/Deploy-Connectivity-Alerts.json index 7e2a81df9..2173e001d 100644 --- a/patterns/alz/policySetDefinitions/Deploy-Connectivity-Alerts.json +++ b/patterns/alz/policySetDefinitions/Deploy-Connectivity-Alerts.json @@ -4,7 +4,7 @@ "name": "Alerting-Connectivity", "properties": { "displayName": "Deploy Azure Monitor Baseline Alerts for Connectivity", - "description": "Initiative to deploy AMBA alerts relevant to the ALZ Connectivity management group", + "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Network components such as Azure Firewalls, ExpressRoute, VPN, and Private DNS Zones.", "metadata": { "version": "1.1.1", "category": "Monitoring", @@ -41,6 +41,27 @@ "description": "Location of the resource group where the ALZ Monitor resources will be deployed" } }, + "ALZMonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": "MonitorDisableTagName" + }, + "ALZMonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] + }, "ERCIRQoSDropBitsinPerSecAlertSeverity": { "type": "String", "defaultValue": "2", @@ -2625,6 +2646,18 @@ "description": "Threshold for the alert" } }, + "activityFWDeletePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Activity FW Delete Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, "activityFWDeleteAlertState": { "type": "string", "defaultValue": "true", @@ -2633,6 +2666,18 @@ "description": "Alert state for the alert" } }, + "activityNSGDeletePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Activity NSG Delete Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, "activityNSGDeleteAlertState": { "type": "string", "defaultValue": "true", @@ -2641,6 +2686,18 @@ "description": "Alert state for the alert" } }, + "activityUDRUpdatePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Activity UDR Update Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, "activityUDRUpdateAlertState": { "type": "string", "defaultValue": "true", @@ -2649,6 +2706,18 @@ "description": "Alert state for the alert" } }, + "activityVPNGWDeletePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Activity VPN GW Delete Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, "activityVPNGWDeleteAlertState": { "type": "string", "defaultValue": "true", @@ -3425,6 +3494,12 @@ }, "enabled": { "value": "[[parameters('ERCIRQoSDropBitsinPerSecAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -3446,6 +3521,12 @@ }, "enabled": { "value": "[[parameters('ERCIRQoSDropBitsoutPerSecAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -3470,6 +3551,12 @@ }, "threshold": { "value": "[[parameters('VPNGwBGPPeerStatusThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -3494,6 +3581,12 @@ }, "threshold": { "value": "[[parameters('VnetGwERCpuUtilThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -3518,6 +3611,12 @@ }, "threshold": { "value": "[[parameters('VnetGwTunnelBWThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -3542,6 +3641,12 @@ }, "threshold": { "value": "[[parameters('VnetGwTunnelEgressThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -3566,6 +3671,12 @@ }, "threshold": { "value": "[[parameters('VnetGwTunnelIngressThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -3590,6 +3701,12 @@ }, "threshold": { "value": "[[parameters('VPNGWBandWidthUtilThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -3614,6 +3731,12 @@ }, "threshold": { "value": "[[parameters('VPNGWEgressThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -3635,6 +3758,12 @@ }, "enabled": { "value": "[[parameters('VPNGWTunnelEgressPacketDropCountAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -3656,6 +3785,12 @@ }, "enabled": { "value": "[[parameters('VPNGWTunnelEgressPacketDropMismatchAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -3683,6 +3818,12 @@ }, "autoMitigate": { "value": "[[parameters('VPNGWIngressAutoMitigate')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -3704,6 +3845,12 @@ }, "enabled": { "value": "[[parameters('VPNGWTunnelIngressPacketDropCountAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -3725,6 +3872,12 @@ }, "enabled": { "value": "[[parameters('VPNGWTunnelIngressPacketDropMismatchAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -3749,6 +3902,12 @@ }, "threshold": { "value": "[[parameters('PDNSZCapacityUtilThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -3773,6 +3932,12 @@ }, "threshold": { "value": "[[parameters('PDNSZQueryVolumeThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -3797,6 +3962,12 @@ }, "threshold": { "value": "[[parameters('PDNSZRecordSetCapacityThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -3821,6 +3992,12 @@ }, "threshold": { "value": "[[parameters('PDNSZRegistrationCapacityUtilThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -3845,6 +4022,12 @@ }, "threshold": { "value": "[[parameters('ERGwExpressRouteBitsInThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -3869,6 +4052,12 @@ }, "threshold": { "value": "[[parameters('ERGwExpressRouteBitsOutThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -3893,6 +4082,12 @@ }, "threshold": { "value": "[[parameters('ERGwExpressRouteCpuUtilThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -3914,6 +4109,12 @@ }, "enabled": { "value": "[[parameters('VnetGwTunnelEgressPacketDropCountAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -3935,6 +4136,12 @@ }, "enabled": { "value": "[[parameters('VnetGwTunnelEgressPacketDropMismatchAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -3959,6 +4166,12 @@ }, "threshold": { "value": "[[parameters('VnetGwExpressRouteBitsPerSecondThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -3980,6 +4193,12 @@ }, "enabled": { "value": "[[parameters('VnetGwTunnelIngressPacketDropMismatchAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -4001,6 +4220,12 @@ }, "enabled": { "value": "[[parameters('VnetGwTunnelIngressPacketDropCountAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -4025,6 +4250,12 @@ }, "threshold": { "value": "[[parameters('ERCIRBgpAvailabilityThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -4049,6 +4280,12 @@ }, "threshold": { "value": "[[parameters('ERCIRArpAvailabilityThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -4073,6 +4310,12 @@ }, "threshold": { "value": "[[parameters('AFWSNATPortUtilizationThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -4097,6 +4340,12 @@ }, "threshold": { "value": "[[parameters('PIPBytesInDDoSThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -4121,6 +4370,12 @@ }, "threshold": { "value": "[[parameters('PIPDDoSAttackThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -4145,6 +4400,12 @@ }, "threshold": { "value": "[[parameters('PIPPacketsInDDoSThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -4169,6 +4430,12 @@ }, "threshold": { "value": "[[parameters('PIPVIPAvailabilityThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -4193,6 +4460,12 @@ }, "threshold": { "value": "[[parameters('VNETDDOSAttackThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -4217,6 +4490,12 @@ }, "threshold": { "value": "[[parameters('FirewallHealthThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -4224,6 +4503,9 @@ "policyDefinitionReferenceId": "ALZ_activityFWDelete", "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_Firewall_Delete", "parameters": { + "effect": { + "value": "[[parameters('activityFWDeletePolicyEffect')]" + }, "enabled": { "value": "[[parameters('activityFWDeleteAlertState')]" }, @@ -4235,6 +4517,12 @@ }, "alertResourceGroupLocation": { "value": "[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -4242,6 +4530,9 @@ "policyDefinitionReferenceId": "ALZ_activityNSGDelete", "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_NSG_Delete", "parameters": { + "effect": { + "value": "[[parameters('activityNSGDeletePolicyEffect')]" + }, "enabled": { "value": "[[parameters('activityNSGDeleteAlertState')]" }, @@ -4253,6 +4544,12 @@ }, "alertResourceGroupLocation": { "value": "[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -4260,6 +4557,9 @@ "policyDefinitionReferenceId": "ALZ_activityUDRUpdate", "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_RouteTable_Update", "parameters": { + "effect": { + "value": "[[parameters('activityUDRUpdatePolicyEffect')]" + }, "enabled": { "value": "[[parameters('activityUDRUpdateAlertState')]" }, @@ -4271,6 +4571,12 @@ }, "alertResourceGroupLocation": { "value": "[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -4278,6 +4584,9 @@ "policyDefinitionReferenceId": "ALZ_activityVPNGWDelete", "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_VPNGateway_Delete", "parameters": { + "effect": { + "value": "[[parameters('activityVPNGWDeletePolicyEffect')]" + }, "enabled": { "value": "[[parameters('activityVPNGWDeleteAlertState')]" }, @@ -4289,6 +4598,12 @@ }, "alertResourceGroupLocation": { "value": "[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -4310,6 +4625,12 @@ }, "enabled": { "value": "[[parameters('LBDataPathAvailabilityAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -4331,6 +4652,12 @@ }, "enabled": { "value": "[[parameters('LBGlobalBackendAvailabilityAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -4352,6 +4679,12 @@ }, "enabled": { "value": "[[parameters('LBHealthProbeStatusAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -4373,6 +4706,12 @@ }, "enabled": { "value": "[[parameters('LBUsedSNATPortsAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -4394,6 +4733,12 @@ }, "enabled": { "value": "[[parameters('ERPBitsInPerSecondAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -4415,6 +4760,12 @@ }, "enabled": { "value": "[[parameters('ERPBitsOutPerSecondAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -4436,6 +4787,12 @@ }, "enabled": { "value": "[[parameters('ERPLineProtocolAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -4457,6 +4814,12 @@ }, "enabled": { "value": "[[parameters('ERPRxLightLevelHighAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -4478,6 +4841,12 @@ }, "enabled": { "value": "[[parameters('ERPRxLightLevelLowAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -4499,6 +4868,12 @@ }, "enabled": { "value": "[[parameters('ERPTxLightLevelHighAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -4520,6 +4895,12 @@ }, "enabled": { "value": "[[parameters('ERPTxLightLevelLowAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } } diff --git a/patterns/alz/policySetDefinitions/Deploy-HybridVM-Alerts.json b/patterns/alz/policySetDefinitions/Deploy-HybridVM-Alerts.json index 72f177f28..b8406f23b 100644 --- a/patterns/alz/policySetDefinitions/Deploy-HybridVM-Alerts.json +++ b/patterns/alz/policySetDefinitions/Deploy-HybridVM-Alerts.json @@ -4,9 +4,9 @@ "name": "Alerting-HybridVM", "properties": { "displayName": "Deploy Azure Monitor Baseline Alerts for Hybrid VMs", - "description": "Initiative to deploy AMBA Hybrid VM alerts", + "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Azure Arc-enabled Servers.", "metadata": { - "version": "1.0.1", + "version": "1.1.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -41,6 +41,27 @@ "description": "Location of the resource group where the ALZ Monitor resources will be deployed" } }, + "ALZMonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": "MonitorDisable" + }, + "ALZMonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] + }, "ALZUserAssignedManagedIdentityName": { "type": "string", "defaultValue": "id-AMBA-ARG-Reader-001", @@ -168,11 +189,7 @@ "type": "string", "defaultValue": "GreaterThan", "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" + "GreaterThan" ], "metadata": { "displayName": "Hybrid VM Heart Beat RG Operator", @@ -181,19 +198,33 @@ }, "HybridVMHeartBeatRGTimeAggregation": { "type": "string", - "defaultValue": "Average", + "defaultValue": "Count", "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" + "Count" ], "metadata": { "displayName": "Hybrid VM Heart Beat RG Time Aggregation", "description": "Time Aggregation for the alert" } }, + "HybridVMHeartBeatRGComputersToInclude": { + "type": "array", + "defaultValue": [ + "*" + ], + "metadata": { + "displayName": "Hybrid VM Heart Beat RG Computers To Include", + "description": "Computers To Include for the alert" + } + }, + "HybridVMHeartBeatRGFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "HybridVM Heart Beat RG Failing Periods", + "description": "Failing Periods for the alert" + } + }, "HybridVMNetworkInAlertSeverity": { "type": "String", "defaultValue": "2", @@ -298,11 +329,7 @@ "type": "string", "defaultValue": "GreaterThan", "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" + "GreaterThan" ], "metadata": { "displayName": "Hybrid VM Network In Operator", @@ -311,13 +338,9 @@ }, "HybridVMNetworkInTimeAggregation": { "type": "string", - "defaultValue": "Average", + "defaultValue": "Count", "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" + "Count" ], "metadata": { "displayName": "Hybrid VM Network In Time Aggregation", @@ -350,16 +373,6 @@ "description": "Computers To Include for the alert" } }, - "HybridVMNetworkInNetworkInterfaceToInclude": { - "type": "array", - "defaultValue": [ - "*" - ], - "metadata": { - "displayName": "Hybrid VM Network In Network Interface To Include", - "description": "Network Interface To Include for the alert" - } - }, "HybridVMNetworkOutAlertSeverity": { "type": "String", "defaultValue": "2", @@ -464,11 +477,7 @@ "type": "string", "defaultValue": "GreaterThan", "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" + "GreaterThan" ], "metadata": { "displayName": "Hybrid VM Network Out Operator", @@ -477,13 +486,9 @@ }, "HybridVMNetworkOutTimeAggregation": { "type": "string", - "defaultValue": "Average", + "defaultValue": "Count", "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" + "Count" ], "metadata": { "displayName": "Hybrid VM Network Out Time Aggregation", @@ -516,16 +521,6 @@ "description": "Computers To Include for the alert" } }, - "HybridVMNetworkOutNetworkInterfaceToInclude": { - "type": "array", - "defaultValue": [ - "*" - ], - "metadata": { - "displayName": "Hybrid VM Network Out Network Interface To Include", - "description": "Network Interface To Include for the alert" - } - }, "HybridVMOSDiskReadLatencyAlertSeverity": { "type": "String", "defaultValue": "2", @@ -630,11 +625,7 @@ "type": "string", "defaultValue": "GreaterThan", "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" + "GreaterThan" ], "metadata": { "displayName": "Hybrid VM OS Disk Read Latency Operator", @@ -643,13 +634,9 @@ }, "HybridVMOSDiskReadLatencyTimeAggregation": { "type": "string", - "defaultValue": "Average", + "defaultValue": "Count", "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" + "Count" ], "metadata": { "displayName": "Hybrid VM OS Disk Read Latency Time Aggregation", @@ -682,17 +669,6 @@ "description": "Computers To Include for the alert" } }, - "HybridVMOSDiskReadLatencyDisksToInclude": { - "type": "array", - "defaultValue": [ - "C:", - "/" - ], - "metadata": { - "displayName": "Hybrid VM OS Disk Read Latency Disks To Include", - "description": "Disks To Include for the alert" - } - }, "HybridVMOSDiskWriteLatencyAlertSeverity": { "type": "String", "defaultValue": "2", @@ -797,11 +773,7 @@ "type": "string", "defaultValue": "GreaterThan", "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" + "GreaterThan" ], "metadata": { "displayName": "Hybrid VM OS Disk Write Latency Operator", @@ -810,13 +782,9 @@ }, "HybridVMOSDiskWriteLatencyTimeAggregation": { "type": "string", - "defaultValue": "Average", + "defaultValue": "Count", "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" + "Count" ], "metadata": { "displayName": "Hybrid VM OS Disk Write Latency Time Aggregation", @@ -849,17 +817,6 @@ "description": "Computers To Include for the alert" } }, - "HybridVMOSDiskWriteLatencyDisksToInclude": { - "type": "array", - "defaultValue": [ - "C:", - "/" - ], - "metadata": { - "displayName": "Hybrid VM OS Disk Write Latency Disks To Include", - "description": "Disks To Include for the alert" - } - }, "HybridVMOSDiskSpaceAlertSeverity": { "type": "String", "defaultValue": "2", @@ -962,13 +919,9 @@ }, "HybridVMOSDiskSpaceOperator": { "type": "string", - "defaultValue": "LessThan", + "defaultValue": "GreaterThan", "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" + "GreaterThan" ], "metadata": { "displayName": "Hybrid VM OS Disk Space Operator", @@ -977,13 +930,9 @@ }, "HybridVMOSDiskSpaceTimeAggregation": { "type": "string", - "defaultValue": "Average", + "defaultValue": "Count", "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" + "Count" ], "metadata": { "displayName": "Hybrid VM OS Disk Space Time Aggregation", @@ -1016,17 +965,6 @@ "description": "Computers To Include for the alert" } }, - "HybridVMOSDiskSpaceDisksToInclude": { - "type": "array", - "defaultValue": [ - "C:", - "/" - ], - "metadata": { - "displayName": "Hybrid VM OS Disk Space Disks To Include", - "description": "Disks To Include for the alert" - } - }, "HybridVMPercentCPUAlertSeverity": { "type": "String", "defaultValue": "2", @@ -1131,11 +1069,7 @@ "type": "string", "defaultValue": "GreaterThan", "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" + "GreaterThan" ], "metadata": { "displayName": "Hybrid VM Percent CPU Operator", @@ -1144,19 +1078,23 @@ }, "HybridVMPercentCPUTimeAggregation": { "type": "string", - "defaultValue": "Average", + "defaultValue": "Count", "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" + "Count" ], "metadata": { "displayName": "Hybrid VM Percent CPU Time Aggregation", "description": "Time Aggregation for the alert" } }, + "HybridVMPercentCPUFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "Hybrid VM Percent CPU Failing Periods", + "description": "Failing Periods for the alert" + } + }, "HybridVMPercentMemoryAlertSeverity": { "type": "String", "defaultValue": "2", @@ -1259,13 +1197,9 @@ }, "HybridVMPercentMemoryOperator": { "type": "string", - "defaultValue": "LessThan", + "defaultValue": "GreaterThan", "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" + "GreaterThan" ], "metadata": { "displayName": "Hybrid VM Percent Memory Operator", @@ -1274,19 +1208,23 @@ }, "HybridVMPercentMemoryTimeAggregation": { "type": "string", - "defaultValue": "Average", + "defaultValue": "Count", "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" + "Count" ], "metadata": { "displayName": "Hybrid VM Percent Memory Time Aggregation", "description": "Time Aggregation for the alert" } }, + "HybridVMPercentMemoryFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "Hybrid VM Percent Memory Failing Periods", + "description": "Failing Periods for the alert" + } + }, "HybridVMDataDiskSpaceAlertSeverity": { "type": "String", "defaultValue": "2", @@ -1389,13 +1327,9 @@ }, "HybridVMDataDiskSpaceOperator": { "type": "string", - "defaultValue": "LessThan", + "defaultValue": "GreaterThan", "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" + "GreaterThan" ], "metadata": { "displayName": "Hybrid VM Data Disk Space Operator", @@ -1404,13 +1338,9 @@ }, "HybridVMDataDiskSpaceTimeAggregation": { "type": "string", - "defaultValue": "Average", + "defaultValue": "Count", "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" + "Count" ], "metadata": { "displayName": "Hybrid VM Data Disk Space Time Aggregation", @@ -1433,14 +1363,14 @@ "description": "Failing Periods for the alert" } }, - "HybridVMDataDiskSpaceDisksToInclude": { + "HybridVMDataDiskSpaceComputersToInclude": { "type": "array", "defaultValue": [ "*" ], "metadata": { - "displayName": "Hybrid VM Data Disk Space Disks To Include", - "description": "Disks To Include for the alert" + "displayName": "Hybrid VM Data Disk Space Computers To Include", + "description": "Computers To Include for the alert" } }, "HybridVMDataDiskReadLatencyAlertSeverity": { @@ -1547,11 +1477,7 @@ "type": "string", "defaultValue": "GreaterThan", "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" + "GreaterThan" ], "metadata": { "displayName": "Hybrid VM Data Disk Read Latency Operator", @@ -1560,13 +1486,9 @@ }, "HybridVMDataDiskReadLatencyTimeAggregation": { "type": "string", - "defaultValue": "Average", + "defaultValue": "Count", "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" + "Count" ], "metadata": { "displayName": "Hybrid VM Data Disk Read Latency Time Aggregation", @@ -1599,16 +1521,6 @@ "description": "Computers To Include for the alert" } }, - "HybridVMDataDiskReadLatencyDisksToInclude": { - "type": "array", - "defaultValue": [ - "*" - ], - "metadata": { - "displayName": "Hybrid VM Data Disk Read Latency Disks To Include", - "description": "Disks To Include for the alert" - } - }, "HybridVMDataDiskWriteLatencyAlertSeverity": { "type": "String", "defaultValue": "2", @@ -1713,11 +1625,7 @@ "type": "string", "defaultValue": "GreaterThan", "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" + "GreaterThan" ], "metadata": { "displayName": "Hybrid VM Data Disk Write Latency Operator", @@ -1726,13 +1634,9 @@ }, "HybridVMDataDiskWriteLatencyTimeAggregation": { "type": "string", - "defaultValue": "Average", + "defaultValue": "Count", "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" + "Count" ], "metadata": { "displayName": "Hybrid VM Data Disk Write Latency Time Aggregation", @@ -1765,16 +1669,6 @@ "description": "Computers To Include for the alert" } }, - "HybridVMDataDiskWriteLatencyDisksToInclude": { - "type": "array", - "defaultValue": [ - "*" - ], - "metadata": { - "displayName": "Hybrid VM Data Disk Write Latency Disks To Include", - "description": "Disks To Include for the alert" - } - }, "HybridVMDisconnectedAlertSeverity": { "type": "String", "defaultValue": "1", @@ -1804,8 +1698,15 @@ }, "HybridVMDisconnectedAlertEvaluationFrequency": { "type": "string", - "defaultValue": "P1D", + "defaultValue": "PT10M", "allowedValues": [ + "PT5M", + "PT10M", + "PT15M", + "PT30M", + "PT1H", + "PT2H", + "PT6H", "PT12H", "P1D" ], @@ -1842,20 +1743,34 @@ "description": "Alert state for the alert, true will enable the alert, false will disable the alert" } }, - "HybridVMDisconnectedAlertDaysThreshold": { + "HybridVMDisconnectedAlertThreshold": { "type": "string", - "defaultValue": "45", + "defaultValue": "10m", + "allowedValues": [ + "5m", + "10m", + "15m", + "30m", + "1h", + "2h", + "3h", + "6h", + "12h", + "1d", + "2d", + "3d", + "7d" + ], "metadata": { - "displayName": "Hybrid VM Disconnected Days Threshold", - "description": "Threshold in days for the Hybrid VM Disconnected alert" + "displayName": "Hybrid VM Disconnected Threshold (expressed in timespan)", + "description": "Threshold in timespan value for the Hybrid VM Disconnected alert" } }, "HybridVMDisconnectedAlertOperator": { "type": "string", - "defaultValue": "GreaterThanOrEqual", + "defaultValue": "GreaterThan", "allowedValues": [ - "GreaterThan", - "GreaterThanOrEqual" + "GreaterThan" ], "metadata": { "displayName": "Hybrid VM Disconnected Operator", @@ -1864,12 +1779,8 @@ }, "HybridVMDisconnectedAlertTimeAggregation": { "type": "string", - "defaultValue": "Minimum", + "defaultValue": "Count", "allowedValues": [ - "Average", - "Maximum", - "Minimum", - "Total", "Count" ], "metadata": { @@ -1899,6 +1810,9 @@ "policyDefinitionReferenceId": "ALZ_HybridVMHeartBeatRG", "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_Hybrid_VM_HeartBeat_Alert", "parameters": { + "UAMIResourceId": { + "value": "[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), concat('/subscriptions/', parameters('ALZManagementSubscriptionId'), '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('ALZUserAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" + }, "alertResourceGroupName": { "value": "[[parameters('ALZMonitorResourceGroupName')]" }, @@ -1940,6 +1854,18 @@ }, "timeAggregation": { "value": "[[parameters('HybridVMHeartBeatRGTimeAggregation')]" + }, + "computersToInclude": { + "value": "[[parameters('HybridVMHeartBeatRGComputersToInclude')]" + }, + "failingPeriods": { + "value": "[[parameters('HybridVMHeartBeatRGFailingPeriods')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -1947,6 +1873,9 @@ "policyDefinitionReferenceId": "ALZ_HybridVMNetworkIn", "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_Hybrid_VM_NetworkIn_Alert", "parameters": { + "UAMIResourceId": { + "value": "[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), concat('/subscriptions/', parameters('ALZManagementSubscriptionId'), '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('ALZUserAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" + }, "severity": { "value": "[[parameters('HybridVMNetworkInAlertSeverity')]" }, @@ -1989,9 +1918,6 @@ "computersToInclude": { "value": "[[parameters('HybridVMNetworkInComputersToInclude')]" }, - "networkInterfacesToInclude": { - "value": "[[parameters('HybridVMNetworkInNetworkInterfaceToInclude')]" - }, "alertResourceGroupName": { "value": "[[parameters('ALZMonitorResourceGroupName')]" }, @@ -2000,6 +1926,12 @@ }, "alertResourceGroupLocation": { "value": "[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -2007,6 +1939,9 @@ "policyDefinitionReferenceId": "ALZ_HybridVMNetworkOut", "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_Hybrid_VM_NetworkOut_Alert", "parameters": { + "UAMIResourceId": { + "value": "[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), concat('/subscriptions/', parameters('ALZManagementSubscriptionId'), '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('ALZUserAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" + }, "severity": { "value": "[[parameters('HybridVMNetworkOutAlertSeverity')]" }, @@ -2049,9 +1984,6 @@ "computersToInclude": { "value": "[[parameters('HybridVMNetworkOutComputersToInclude')]" }, - "networkInterfacesToInclude": { - "value": "[[parameters('HybridVMNetworkOutNetworkInterfaceToInclude')]" - }, "alertResourceGroupName": { "value": "[[parameters('ALZMonitorResourceGroupName')]" }, @@ -2060,6 +1992,12 @@ }, "alertResourceGroupLocation": { "value": "[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -2067,6 +2005,9 @@ "policyDefinitionReferenceId": "ALZ_HybridVMOSDiskReadLatency", "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_Hybrid_VM_OSDiskreadLatency_Alert", "parameters": { + "UAMIResourceId": { + "value": "[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), concat('/subscriptions/', parameters('ALZManagementSubscriptionId'), '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('ALZUserAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" + }, "severity": { "value": "[[parameters('HybridVMOSDiskReadLatencyAlertSeverity')]" }, @@ -2109,9 +2050,6 @@ "computersToInclude": { "value": "[[parameters('HybridVMOSDiskReadLatencyComputersToInclude')]" }, - "disksToInclude": { - "value": "[[parameters('HybridVMOSDiskReadLatencyDisksToInclude')]" - }, "alertResourceGroupName": { "value": "[[parameters('ALZMonitorResourceGroupName')]" }, @@ -2120,6 +2058,12 @@ }, "alertResourceGroupLocation": { "value": "[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -2127,6 +2071,9 @@ "policyDefinitionReferenceId": "ALZ_HybridVMOSDiskWriteLatency", "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_Hybrid_VM_OSDiskwriteLatency_Alert", "parameters": { + "UAMIResourceId": { + "value": "[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), concat('/subscriptions/', parameters('ALZManagementSubscriptionId'), '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('ALZUserAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" + }, "severity": { "value": "[[parameters('HybridVMOSDiskWriteLatencyAlertSeverity')]" }, @@ -2169,9 +2116,6 @@ "computersToInclude": { "value": "[[parameters('HybridVMOSDiskWriteLatencyComputersToInclude')]" }, - "disksToInclude": { - "value": "[[parameters('HybridVMOSDiskWriteLatencyDisksToInclude')]" - }, "alertResourceGroupName": { "value": "[[parameters('ALZMonitorResourceGroupName')]" }, @@ -2180,6 +2124,12 @@ }, "alertResourceGroupLocation": { "value": "[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -2187,6 +2137,9 @@ "policyDefinitionReferenceId": "ALZ_HybridVMOSDiskSpace", "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_Hybrid_VM_OSDiskSpace_Alert", "parameters": { + "UAMIResourceId": { + "value": "[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), concat('/subscriptions/', parameters('ALZManagementSubscriptionId'), '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('ALZUserAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" + }, "severity": { "value": "[[parameters('HybridVMOSDiskSpaceAlertSeverity')]" }, @@ -2229,9 +2182,6 @@ "computersToInclude": { "value": "[[parameters('HybridVMOSDiskSpaceComputersToInclude')]" }, - "disksToInclude": { - "value": "[[parameters('HybridVMOSDiskSpaceDisksToInclude')]" - }, "alertResourceGroupName": { "value": "[[parameters('ALZMonitorResourceGroupName')]" }, @@ -2240,6 +2190,12 @@ }, "alertResourceGroupLocation": { "value": "[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -2247,6 +2203,9 @@ "policyDefinitionReferenceId": "ALZ_HybridVMPercentCPU", "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_Hybrid_VM_CPU_Alert", "parameters": { + "UAMIResourceId": { + "value": "[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), concat('/subscriptions/', parameters('ALZManagementSubscriptionId'), '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('ALZUserAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" + }, "severity": { "value": "[[parameters('HybridVMPercentCPUAlertSeverity')]" }, @@ -2280,6 +2239,9 @@ "timeAggregation": { "value": "[[parameters('HybridVMPercentCPUTimeAggregation')]" }, + "failingPeriods": { + "value": "[[parameters('HybridVMPercentCPUFailingPeriods')]" + }, "alertResourceGroupName": { "value": "[[parameters('ALZMonitorResourceGroupName')]" }, @@ -2288,6 +2250,12 @@ }, "alertResourceGroupLocation": { "value": "[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -2295,6 +2263,9 @@ "policyDefinitionReferenceId": "ALZ_HybridVMPercentMemory", "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_Hybrid_VM_Memory_Alert", "parameters": { + "UAMIResourceId": { + "value": "[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), concat('/subscriptions/', parameters('ALZManagementSubscriptionId'), '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('ALZUserAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" + }, "severity": { "value": "[[parameters('HybridVMPercentMemoryAlertSeverity')]" }, @@ -2328,6 +2299,9 @@ "timeAggregation": { "value": "[[parameters('HybridVMPercentMemoryTimeAggregation')]" }, + "failingPeriods": { + "value": "[[parameters('HybridVMPercentMemoryFailingPeriods')]" + }, "alertResourceGroupName": { "value": "[[parameters('ALZMonitorResourceGroupName')]" }, @@ -2336,6 +2310,12 @@ }, "alertResourceGroupLocation": { "value": "[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -2343,6 +2323,9 @@ "policyDefinitionReferenceId": "ALZ_HybridVMDataDiskSpace", "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_Hybrid_VM_dataDiskSpace_Alert", "parameters": { + "UAMIResourceId": { + "value": "[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), concat('/subscriptions/', parameters('ALZManagementSubscriptionId'), '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('ALZUserAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" + }, "severity": { "value": "[[parameters('HybridVMDataDiskSpaceAlertSeverity')]" }, @@ -2382,8 +2365,8 @@ "evaluationPeriods": { "value": "[[parameters('HybridVMDataDiskSpaceEvaluationPeriods')]" }, - "disksToInclude": { - "value": "[[parameters('HybridVMDataDiskSpaceDisksToInclude')]" + "computersToInclude": { + "value": "[[parameters('HybridVMDataDiskSpaceComputersToInclude')]" }, "alertResourceGroupName": { "value": "[[parameters('ALZMonitorResourceGroupName')]" @@ -2393,6 +2376,12 @@ }, "alertResourceGroupLocation": { "value": "[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -2400,6 +2389,9 @@ "policyDefinitionReferenceId": "ALZ_HybridVMDataDiskReadLatency", "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_Hybrid_VM_dataDiskReadLatency_Alert", "parameters": { + "UAMIResourceId": { + "value": "[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), concat('/subscriptions/', parameters('ALZManagementSubscriptionId'), '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('ALZUserAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" + }, "severity": { "value": "[[parameters('HybridVMDataDiskReadLatencyAlertSeverity')]" }, @@ -2442,9 +2434,6 @@ "computersToInclude": { "value": "[[parameters('HybridVMDataDiskReadLatencyComputersToInclude')]" }, - "disksToInclude": { - "value": "[[parameters('HybridVMDataDiskReadLatencyDisksToInclude')]" - }, "alertResourceGroupName": { "value": "[[parameters('ALZMonitorResourceGroupName')]" }, @@ -2453,6 +2442,12 @@ }, "alertResourceGroupLocation": { "value": "[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -2460,6 +2455,9 @@ "policyDefinitionReferenceId": "ALZ_HybridVMDataDiskWriteLatency", "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_Hybrid_VM_dataDiskWriteLatency_Alert", "parameters": { + "UAMIResourceId": { + "value": "[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), concat('/subscriptions/', parameters('ALZManagementSubscriptionId'), '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('ALZUserAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" + }, "severity": { "value": "[[parameters('HybridVMDataDiskWriteLatencyAlertSeverity')]" }, @@ -2502,9 +2500,6 @@ "computersToInclude": { "value": "[[parameters('HybridVMDataDiskWriteLatencyComputersToInclude')]" }, - "disksToInclude": { - "value": "[[parameters('HybridVMDataDiskWriteLatencyDisksToInclude')]" - }, "alertResourceGroupName": { "value": "[[parameters('ALZMonitorResourceGroupName')]" }, @@ -2513,6 +2508,12 @@ }, "alertResourceGroupLocation": { "value": "[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -2520,14 +2521,8 @@ "policyDefinitionReferenceId": "ALZ_HybridVMDisconnected", "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_Hybrid_VM_Disconnected_Alert", "parameters": { - "userAssignedManagedIdentityName": { - "value": "[[parameters('ALZUserAssignedManagedIdentityName')]" - }, - "managementSubscriptionId": { - "value": "[[parameters('ALZManagementSubscriptionId')]" - }, - "BYOUserAssignedManagedIdentityResourceId": { - "value": "[[parameters('BYOUserAssignedManagedIdentityResourceId')]" + "UAMIResourceId": { + "value": "[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), concat('/subscriptions/', parameters('ALZManagementSubscriptionId'), '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('ALZUserAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" }, "severity": { "value": "[[parameters('HybridVMDisconnectedAlertSeverity')]" @@ -2548,7 +2543,7 @@ "value": "[[parameters('HybridVMDisconnectedAlertState')]" }, "threshold": { - "value": "[[parameters('HybridVMDisconnectedAlertDaysThreshold')]" + "value": "[[parameters('HybridVMDisconnectedAlertThreshold')]" }, "operator": { "value": "[[parameters('HybridVMDisconnectedAlertOperator')]" @@ -2570,6 +2565,12 @@ }, "alertResourceGroupLocation": { "value": "[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } } @@ -2577,4 +2578,4 @@ "policyType": "Custom", "policyDefinitionGroups": null } -} \ No newline at end of file +} diff --git a/patterns/alz/policySetDefinitions/Deploy-Identity-Alerts.json b/patterns/alz/policySetDefinitions/Deploy-Identity-Alerts.json index 8c1a6d22e..f74086708 100644 --- a/patterns/alz/policySetDefinitions/Deploy-Identity-Alerts.json +++ b/patterns/alz/policySetDefinitions/Deploy-Identity-Alerts.json @@ -6,7 +6,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Identity", "description": "Initiative to deploy AMBA alerts relevant to the ALZ Identity management group", "metadata": { - "version": "1.0.3", + "version": "1.1.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -41,6 +41,27 @@ "description": "Location of the resource group where the alerting resources will be deployed" } }, + "ALZMonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": "MonitorDisable" + }, + "ALZMonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] + }, "KVRequestAlertSeverity": { "type": "String", "defaultValue": "2", @@ -344,6 +365,190 @@ "displayName": "Activity Log KeyVault Delete Alert State", "description": "State of the alert, true will enable the alert, false will disable the alert" } + }, + "activityKVDeletePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Key Vault Delete Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "HSMsAvailabilityAlertSeverity": { + "type": "String", + "defaultValue": "1", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "Key Vault Managed HSMs Availability Alert Severity", + "description": "Severity of the alert for Key Vault Managed HSMs Availability" + } + }, + "HSMsAvailabilityWindowSize": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "Key Vault Managed HSMs Availability Window Size", + "description": "Window size for the alert" + } + }, + "HSMsAvailabilityEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "Key Vault Managed HSMs Availability Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "HSMsAvailabilityPolicyEffect": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Key Vault Managed HSMs Availability Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "HSMsAvailabilityAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Key Vault Managed HSMs Availability Alert State", + "description": "Alert state for the alert" + } + }, + "HSMsAvailabilityThreshold": { + "type": "string", + "defaultValue": "20", + "metadata": { + "displayName": "Key Vault Managed HSMs Availability Threshold", + "description": "Threshold for the alert" + } + }, + "HSMsLatencyAvailabilityAlertSeverity": { + "type": "String", + "defaultValue": "3", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "Key Vault Managed HSMs Latency Availability Alert Severity", + "description": "Severity of the alert for Key Vault Managed HSMs Latency Availability" + } + }, + "HSMsLatencyAvailabilityWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "Key Vault Managed HSMs Latency Availability Window Size", + "description": "Window size for the alert" + } + }, + "HSMsLatencyAvailabilityEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "Key Vault Managed HSMs Latency Availability Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "HSMsLatencyAvailabilityPolicyEffect": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Key Vault Managed HSMs Latency Availability Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "HSMsLatencyAvailabilityAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Key Vault Managed HSMs Latency Availability Alert State", + "description": "Alert state for the alert" + } + }, + "HSMsLatencyAvailabilityThreshold": { + "type": "string", + "defaultValue": "1000", + "metadata": { + "displayName": "Key Vault Managed HSMs Latency Availability Threshold", + "description": "Threshold for the alert" + } + }, + "activityHSMsDeleteAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Activity Key Vault Managed HSMs Delete Alert State", + "description": "Alert state for the alert" + } + }, + "activityHSMsDeletePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Key Vault Managed HSMs Delete Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } } }, "policyDefinitions": [ @@ -365,6 +570,12 @@ }, "enabled": { "value": "[[parameters('KVRequestAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -389,6 +600,12 @@ }, "threshold": { "value": "[[parameters('KVAvailabilityThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -413,6 +630,12 @@ }, "threshold": { "value": "[[parameters('KvLatencyAvailabilityThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -437,6 +660,12 @@ }, "threshold": { "value": "[[parameters('KVCapacityThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -444,6 +673,9 @@ "policyDefinitionReferenceId": "ALZ_activityKVDelete", "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_KeyVault_Delete", "parameters": { + "effect": { + "value": "[[parameters('activityKVDeletePolicyEffect')]" + }, "enabled": { "value": "[[parameters('activityKVDeleteAlertState')]" }, @@ -455,6 +687,99 @@ }, "alertResourceGroupLocation": { "value": "[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_ManagedHSMsAvailability", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ManagedHSMs_Availability_Alert", + "parameters": { + "severity": { + "value": "[[parameters('HSMsAvailabilityAlertSeverity')]" + }, + "windowSize": { + "value": "[[parameters('HSMsAvailabilityWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('HSMsAvailabilityEvaluationFrequency')]" + }, + "effect": { + "value": "[[parameters('HSMsAvailabilityPolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('HSMsAvailabilityAlertState')]" + }, + "threshold": { + "value": "[[parameters('HSMsAvailabilityThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_ManagedHSMsLatencyAvailability", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ManagedHSMs_Latency_Alert", + "parameters": { + "severity": { + "value": "[[parameters('HSMsLatencyAvailabilityAlertSeverity')]" + }, + "windowSize": { + "value": "[[parameters('HSMsLatencyAvailabilityWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('HSMsLatencyAvailabilityEvaluationFrequency')]" + }, + "effect": { + "value": "[[parameters('HSMsLatencyAvailabilityPolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('HSMsLatencyAvailabilityAlertState')]" + }, + "threshold": { + "value": "[[parameters('HSMsLatencyAvailabilityThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_activityManagedHSMsDelete", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ActivityLog_ManagedHSMs_Delete", + "parameters": { + "enabled": { + "value": "[[parameters('activityHSMsDeleteAlertState')]" + }, + "alertResourceGroupName": { + "value": "[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "effect": { + "value": "[[parameters('activityHSMsDeletePolicyEffect')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } } diff --git a/patterns/alz/policySetDefinitions/Deploy-KeyManagement-Alerts.json b/patterns/alz/policySetDefinitions/Deploy-KeyManagement-Alerts.json new file mode 100644 index 000000000..15509b665 --- /dev/null +++ b/patterns/alz/policySetDefinitions/Deploy-KeyManagement-Alerts.json @@ -0,0 +1,790 @@ +{ + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "name": "Alerting-KeyManagement", + "properties": { + "displayName": "Deploy Azure Monitor Baseline Alerts for Key Management", + "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Key Management Services such as Azure Key Vault, and Managed HSM.", + "metadata": { + "version": "1.0.0", + "category": "Monitoring", + "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", + "alzCloudEnvironments": [ + "AzureCloud" + ], + "_deployed_by_amba": true + }, + "parameters": { + "ALZMonitorResourceGroupName": { + "type": "String", + "defaultValue": "ALZ-Monitoring-RG", + "metadata": { + "displayName": "ALZ Monitor Resource Group Name", + "description": "Name of the resource group where the ALZ Monitor resources will be deployed" + } + }, + "ALZMonitorResourceGroupTags": { + "type": "Object", + "defaultValue": { + "_deployed_by_amba": true + }, + "metadata": { + "displayName": "ALZ Monitor Resource Group Tags", + "description": "Tags for the resource group where the ALZ Monitor resources will be deployed" + } + }, + "ALZMonitorResourceGroupLocation": { + "type": "String", + "defaultValue": "centralus", + "metadata": { + "displayName": "ALZ Monitor Resource Group Location", + "description": "Location of the resource group where the ALZ Monitor resources will be deployed" + } + }, + "ALZMonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": "MonitorDisable" + }, + "ALZMonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] + }, + "KVRequestAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "Key Vault Request Alert Severity", + "description": "Severity of the alert for Key Vault Request" + } + }, + "KVRequestWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "Key Vault Request Window Size", + "description": "Window size for the alert" + } + }, + "KVRequestEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "Key Vault Request Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "KVRequestPolicyEffect": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Key Vault Request Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "KVRequestAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Key Vault Request Alert State", + "description": "Alert state for the alert" + } + }, + "KvAvailabilityAlertSeverity": { + "type": "String", + "defaultValue": "1", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "Key Vault Availability Alert Severity", + "description": "Severity of the alert for Key Vault Availability" + } + }, + "KvAvailabilityWindowSize": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "Key Vault Availability Window Size", + "description": "Window size for the alert" + } + }, + "KvAvailabilityEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "Key Vault Availability Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "KvAvailabilityPolicyEffect": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Key Vault Availability Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "KvAvailabilityAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Key Vault Availability Alert State", + "description": "Alert state for the alert" + } + }, + "KVAvailabilityThreshold": { + "type": "string", + "defaultValue": "20", + "metadata": { + "displayName": "Key Vault Availability Threshold", + "description": "Threshold for the alert" + } + }, + "KvLatencyAvailabilityAlertSeverity": { + "type": "String", + "defaultValue": "3", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "Key Vault Latency Availability Alert Severity", + "description": "Severity of the alert for Key Vault Latency Availability" + } + }, + "KvLatencyAvailabilityWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "Key Vault Latency Availability Window Size", + "description": "Window size for the alert" + } + }, + "KvLatencyAvailabilityEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "Key Vault Latency Availability Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "KvLatencyAvailabilityPolicyEffect": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Key Vault Latency Availability Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "KvLatencyAvailabilityAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Key Vault Latency Availability Alert State", + "description": "Alert state for the alert" + } + }, + "KvLatencyAvailabilityThreshold": { + "type": "string", + "defaultValue": "1000", + "metadata": { + "displayName": "Key Vault Latency Availability Threshold", + "description": "Threshold for the alert" + } + }, + "KVCapacityAlertSeverity": { + "type": "String", + "defaultValue": "1", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "Key Vault Capacity Alert Severity", + "description": "Severity of the alert for Key Vault Capacity" + } + }, + "KVCapacityWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "Key Vault Capacity Window Size", + "description": "Window size for the alert" + } + }, + "KVCapacityEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "Key Vault Capacity Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "KVCapacityPolicyEffect": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Key Vault Capacity Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "KVCapacityAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Key Vault Capacity Alert State", + "description": "Alert state for the alert" + } + }, + "KVCapacityThreshold": { + "type": "string", + "defaultValue": "75", + "metadata": { + "displayName": "Key Vault Capacity Threshold", + "description": "Threshold for the alert" + } + }, + "activityKVDeleteAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Activity Key Vault Delete Alert State", + "description": "Alert state for the alert" + } + }, + "activityKVDeletePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Key Vault Delete Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "HSMsAvailabilityAlertSeverity": { + "type": "String", + "defaultValue": "1", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "Key Vault Managed HSMs Availability Alert Severity", + "description": "Severity of the alert for Key Vault Managed HSMs Availability" + } + }, + "HSMsAvailabilityWindowSize": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "Key Vault Managed HSMs Availability Window Size", + "description": "Window size for the alert" + } + }, + "HSMsAvailabilityEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "Key Vault Managed HSMs Availability Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "HSMsAvailabilityPolicyEffect": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Key Vault Managed HSMs Availability Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "HSMsAvailabilityAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Key Vault Managed HSMs Availability Alert State", + "description": "Alert state for the alert" + } + }, + "HSMsAvailabilityThreshold": { + "type": "string", + "defaultValue": "20", + "metadata": { + "displayName": "Key Vault Managed HSMs Availability Threshold", + "description": "Threshold for the alert" + } + }, + "HSMsLatencyAvailabilityAlertSeverity": { + "type": "String", + "defaultValue": "3", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "Key Vault Managed HSMs Latency Availability Alert Severity", + "description": "Severity of the alert for Key Vault Managed HSMs Latency Availability" + } + }, + "HSMsLatencyAvailabilityWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "Key Vault Managed HSMs Latency Availability Window Size", + "description": "Window size for the alert" + } + }, + "HSMsLatencyAvailabilityEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "Key Vault Managed HSMs Latency Availability Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "HSMsLatencyAvailabilityPolicyEffect": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Key Vault Managed HSMs Latency Availability Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "HSMsLatencyAvailabilityAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Key Vault Managed HSMs Latency Availability Alert State", + "description": "Alert state for the alert" + } + }, + "HSMsLatencyAvailabilityThreshold": { + "type": "string", + "defaultValue": "1000", + "metadata": { + "displayName": "Key Vault Managed HSMs Latency Availability Threshold", + "description": "Threshold for the alert" + } + }, + "activityHSMsDeleteAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Activity Key Vault Managed HSMs Delete Alert State", + "description": "Alert state for the alert" + } + }, + "activityHSMsDeletePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Key Vault Managed HSMs Delete Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "ALZ_KVRequest", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_KeyVault_Requests_Alert", + "parameters": { + "severity": { + "value": "[[parameters('KVRequestAlertSeverity')]" + }, + "windowSize": { + "value": "[[parameters('KVRequestWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('KVRequestEvaluationFrequency')]" + }, + "effect": { + "value": "[[parameters('KVRequestPolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('KVRequestAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_KvAvailability", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_KeyVault_Availability_Alert", + "parameters": { + "severity": { + "value": "[[parameters('KvAvailabilityAlertSeverity')]" + }, + "windowSize": { + "value": "[[parameters('KvAvailabilityWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('KvAvailabilityEvaluationFrequency')]" + }, + "effect": { + "value": "[[parameters('KvAvailabilityPolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('KvAvailabilityAlertState')]" + }, + "threshold": { + "value": "[[parameters('KVAvailabilityThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_KvLatencyAvailability", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_KeyVault_Latency_Alert", + "parameters": { + "severity": { + "value": "[[parameters('KvLatencyAvailabilityAlertSeverity')]" + }, + "windowSize": { + "value": "[[parameters('KvLatencyAvailabilityWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('KvLatencyAvailabilityEvaluationFrequency')]" + }, + "effect": { + "value": "[[parameters('KvLatencyAvailabilityPolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('KvLatencyAvailabilityAlertState')]" + }, + "threshold": { + "value": "[[parameters('KvLatencyAvailabilityThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_KVCapacity", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_KeyVault_Capacity_Alert", + "parameters": { + "severity": { + "value": "[[parameters('KVCapacityAlertSeverity')]" + }, + "windowSize": { + "value": "[[parameters('KVCapacityWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('KVCapacityEvaluationFrequency')]" + }, + "effect": { + "value": "[[parameters('KVCapacityPolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('KVCapacityAlertState')]" + }, + "threshold": { + "value": "[[parameters('KVCapacityThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_activityKVDelete", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_KeyVault_Delete", + "parameters": { + "enabled": { + "value": "[[parameters('activityKVDeleteAlertState')]" + }, + "alertResourceGroupName": { + "value": "[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "effect": { + "value": "[[parameters('activityKVDeletePolicyEffect')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_ManagedHSMsAvailability", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ManagedHSMs_Availability_Alert", + "parameters": { + "severity": { + "value": "[[parameters('HSMsAvailabilityAlertSeverity')]" + }, + "windowSize": { + "value": "[[parameters('HSMsAvailabilityWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('HSMsAvailabilityEvaluationFrequency')]" + }, + "effect": { + "value": "[[parameters('HSMsAvailabilityPolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('HSMsAvailabilityAlertState')]" + }, + "threshold": { + "value": "[[parameters('HSMsAvailabilityThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_ManagedHSMsLatencyAvailability", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ManagedHSMs_Latency_Alert", + "parameters": { + "severity": { + "value": "[[parameters('HSMsLatencyAvailabilityAlertSeverity')]" + }, + "windowSize": { + "value": "[[parameters('HSMsLatencyAvailabilityWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('HSMsLatencyAvailabilityEvaluationFrequency')]" + }, + "effect": { + "value": "[[parameters('HSMsLatencyAvailabilityPolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('HSMsLatencyAvailabilityAlertState')]" + }, + "threshold": { + "value": "[[parameters('HSMsLatencyAvailabilityThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_activityManagedHSMsDelete", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ActivityLog_ManagedHSMs_Delete", + "parameters": { + "enabled": { + "value": "[[parameters('activityHSMsDeleteAlertState')]" + }, + "alertResourceGroupName": { + "value": "[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "effect": { + "value": "[[parameters('activityHSMsDeletePolicyEffect')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + } + ], + "policyType": "Custom", + "policyDefinitionGroups": null + } +} diff --git a/patterns/alz/policySetDefinitions/Deploy-LandingZone-Alerts.json b/patterns/alz/policySetDefinitions/Deploy-LandingZone-Alerts.json index fda6330db..6f11179bc 100644 --- a/patterns/alz/policySetDefinitions/Deploy-LandingZone-Alerts.json +++ b/patterns/alz/policySetDefinitions/Deploy-LandingZone-Alerts.json @@ -3,12 +3,14 @@ "apiVersion": "2021-06-01", "name": "Alerting-LandingZone", "properties": { - "displayName": "Deploy Azure Monitor Baseline Alerts for Landing Zone", + "displayName": "[Deprecated]: Deploy Azure Monitor Baseline Alerts for Landing Zone", "description": "Initiative to deploy AMBA alerts relevant to the ALZ LandingZone management group", "metadata": { - "version": "1.1.0", + "version": "1.1.0-deprecated", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", + "deprecated": true, + "supersededBy": "Alerting-KeyManagement, Alerting-LoadBalancing, Alerting-NetworkChanges, Alerting-RecoveryServices, Alerting-Storage, Alerting-VM, Alerting-Web", "alzCloudEnvironments": [ "AzureCloud" ], @@ -867,7 +869,7 @@ }, "VMHeartBeatRGWindowSize": { "type": "string", - "defaultValue": "PT15M", + "defaultValue": "PT6H", "allowedValues": [ "PT1M", "PT5M", @@ -954,11 +956,7 @@ "type": "string", "defaultValue": "GreaterThan", "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" + "GreaterThan" ], "metadata": { "displayName": "VM Heart Beat RG Operator", @@ -967,19 +965,23 @@ }, "VMHeartBeatRGTimeAggregation": { "type": "string", - "defaultValue": "Average", + "defaultValue": "Count", "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" + "Count" ], "metadata": { "displayName": "VM Heart Beat RG Time Aggregation", "description": "Time Aggregation for the alert" } }, + "VMHeartBeatRGFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM Heart Beat RG Failing Periods", + "description": "Failing Periods for the alert" + } + }, "VMNetworkInAlertSeverity": { "type": "String", "defaultValue": "2", @@ -1084,11 +1086,7 @@ "type": "string", "defaultValue": "GreaterThan", "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" + "GreaterThan" ], "metadata": { "displayName": "VM Network In Operator", @@ -1097,13 +1095,9 @@ }, "VMNetworkInTimeAggregation": { "type": "string", - "defaultValue": "Average", + "defaultValue": "Count", "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" + "Count" ], "metadata": { "displayName": "VM Network In Time Aggregation", @@ -1136,16 +1130,6 @@ "description": "Computers To Include for the alert" } }, - "VMNetworkInNetworkInterfaceToInclude": { - "type": "array", - "defaultValue": [ - "*" - ], - "metadata": { - "displayName": "VM Network In Network Interface To Include", - "description": "Network Interface To Include for the alert" - } - }, "VMNetworkOutAlertSeverity": { "type": "String", "defaultValue": "2", @@ -1250,11 +1234,7 @@ "type": "string", "defaultValue": "GreaterThan", "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" + "GreaterThan" ], "metadata": { "displayName": "VM Network Out Operator", @@ -1263,13 +1243,9 @@ }, "VMNetworkOutTimeAggregation": { "type": "string", - "defaultValue": "Average", + "defaultValue": "Count", "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" + "Count" ], "metadata": { "displayName": "VM Network Out Time Aggregation", @@ -1302,16 +1278,6 @@ "description": "Computers To Include for the alert" } }, - "VMNetworkOutNetworkInterfaceToInclude": { - "type": "array", - "defaultValue": [ - "*" - ], - "metadata": { - "displayName": "VM Network Out Network Interface To Include", - "description": "Network Interface To Include for the alert" - } - }, "VMOSDiskReadLatencyAlertSeverity": { "type": "String", "defaultValue": "2", @@ -1416,11 +1382,7 @@ "type": "string", "defaultValue": "GreaterThan", "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" + "GreaterThan" ], "metadata": { "displayName": "VM OS Disk Read Latency Operator", @@ -1429,13 +1391,9 @@ }, "VMOSDiskReadLatencyTimeAggregation": { "type": "string", - "defaultValue": "Average", + "defaultValue": "Count", "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" + "Count" ], "metadata": { "displayName": "VM OS Disk Read Latency Time Aggregation", @@ -1468,17 +1426,6 @@ "description": "Computers To Include for the alert" } }, - "VMOSDiskReadLatencyDisksToInclude": { - "type": "array", - "defaultValue": [ - "C:", - "/" - ], - "metadata": { - "displayName": "VM OS Disk Read Latency Disks To Include", - "description": "Disks To Include for the alert" - } - }, "VMOSDiskWriteLatencyAlertSeverity": { "type": "String", "defaultValue": "2", @@ -1573,7 +1520,7 @@ }, "VMOSDiskWriteLatencyThreshold": { "type": "string", - "defaultValue": "50", + "defaultValue": "30", "metadata": { "displayName": "VM OS Disk Write Latency Threshold", "description": "Threshold for the alert" @@ -1583,11 +1530,7 @@ "type": "string", "defaultValue": "GreaterThan", "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" + "GreaterThan" ], "metadata": { "displayName": "VM OS Disk Write Latency Operator", @@ -1596,13 +1539,9 @@ }, "VMOSDiskWriteLatencyTimeAggregation": { "type": "string", - "defaultValue": "Average", + "defaultValue": "Count", "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" + "Count" ], "metadata": { "displayName": "VM OS Disk Write Latency Time Aggregation", @@ -1635,17 +1574,6 @@ "description": "Computers To Include for the alert" } }, - "VMOSDiskWriteLatencyDisksToInclude": { - "type": "array", - "defaultValue": [ - "C:", - "/" - ], - "metadata": { - "displayName": "VM OS Disk Write Latency Disks To Include", - "description": "Disks To Include for the alert" - } - }, "VMOSDiskSpaceAlertSeverity": { "type": "String", "defaultValue": "2", @@ -1748,13 +1676,9 @@ }, "VMOSDiskSpaceOperator": { "type": "string", - "defaultValue": "LessThan", + "defaultValue": "GreaterThan", "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" + "GreaterThan" ], "metadata": { "displayName": "VM OS Disk Space Operator", @@ -1763,13 +1687,9 @@ }, "VMOSDiskSpaceTimeAggregation": { "type": "string", - "defaultValue": "Average", + "defaultValue": "Count", "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" + "Count" ], "metadata": { "displayName": "VM OS Disk Space Time Aggregation", @@ -1802,17 +1722,6 @@ "description": "Computers To Include for the alert" } }, - "VMOSDiskSpaceDisksToInclude": { - "type": "array", - "defaultValue": [ - "C:", - "/" - ], - "metadata": { - "displayName": "VM OS Disk Space Disks To Include", - "description": "Disks To Include for the alert" - } - }, "VMPercentCPUAlertSeverity": { "type": "String", "defaultValue": "2", @@ -1917,11 +1826,7 @@ "type": "string", "defaultValue": "GreaterThan", "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" + "GreaterThan" ], "metadata": { "displayName": "VM Percent CPU Operator", @@ -1930,19 +1835,23 @@ }, "VMPercentCPUTimeAggregation": { "type": "string", - "defaultValue": "Average", + "defaultValue": "Count", "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" + "Count" ], "metadata": { "displayName": "VM Percent CPU Time Aggregation", "description": "Time Aggregation for the alert" } }, + "VMPercentCPUFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM Percent CPU Failing Periods", + "description": "Failing Periods for the alert" + } + }, "VMPercentMemoryAlertSeverity": { "type": "String", "defaultValue": "2", @@ -2045,13 +1954,9 @@ }, "VMPercentMemoryOperator": { "type": "string", - "defaultValue": "LessThan", + "defaultValue": "GreaterThan", "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" + "GreaterThan" ], "metadata": { "displayName": "VM Percent Memory Operator", @@ -2060,13 +1965,9 @@ }, "VMPercentMemoryTimeAggregation": { "type": "string", - "defaultValue": "Average", + "defaultValue": "Count", "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" + "Count" ], "metadata": { "displayName": "VM Percent Memory Time Aggregation", @@ -2175,13 +2076,9 @@ }, "VMDataDiskSpaceOperator": { "type": "string", - "defaultValue": "LessThan", + "defaultValue": "GreaterThan", "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" + "GreaterThan" ], "metadata": { "displayName": "VM Data Disk Space Operator", @@ -2190,13 +2087,9 @@ }, "VMDataDiskSpaceTimeAggregation": { "type": "string", - "defaultValue": "Average", + "defaultValue": "Count", "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" + "Count" ], "metadata": { "displayName": "VM Data Disk Space Time Aggregation", @@ -2219,16 +2112,6 @@ "description": "Failing Periods for the alert" } }, - "VMDataDiskSpaceDisksToInclude": { - "type": "array", - "defaultValue": [ - "*" - ], - "metadata": { - "displayName": "VM Data Disk Space Disks To Include", - "description": "Disks To Include for the alert" - } - }, "VMDataDiskReadLatencyAlertSeverity": { "type": "String", "defaultValue": "2", @@ -2333,11 +2216,7 @@ "type": "string", "defaultValue": "GreaterThan", "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" + "GreaterThan" ], "metadata": { "displayName": "VM Data Disk Read Latency Operator", @@ -2346,13 +2225,9 @@ }, "VMDataDiskReadLatencyTimeAggregation": { "type": "string", - "defaultValue": "Average", + "defaultValue": "Count", "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" + "Count" ], "metadata": { "displayName": "VM Data Disk Read Latency Time Aggregation", @@ -2385,16 +2260,6 @@ "description": "Computers To Include for the alert" } }, - "VMDataDiskReadLatencyDisksToInclude": { - "type": "array", - "defaultValue": [ - "*" - ], - "metadata": { - "displayName": "VM Data Disk Read Latency Disks To Include", - "description": "Disks To Include for the alert" - } - }, "VMDataDiskWriteLatencyAlertSeverity": { "type": "String", "defaultValue": "2", @@ -2499,11 +2364,7 @@ "type": "string", "defaultValue": "GreaterThan", "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" + "GreaterThan" ], "metadata": { "displayName": "VM Data Disk Write Latency Operator", @@ -2512,13 +2373,9 @@ }, "VMDataDiskWriteLatencyTimeAggregation": { "type": "string", - "defaultValue": "Average", + "defaultValue": "Count", "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" + "Count" ], "metadata": { "displayName": "VM Data Disk Write Latency Time Aggregation", @@ -2551,16 +2408,6 @@ "description": "Computers To Include for the alert" } }, - "VMDataDiskWriteLatencyDisksToInclude": { - "type": "array", - "defaultValue": [ - "*" - ], - "metadata": { - "displayName": "VM Data Disk Write Latency Disks To Include", - "description": "Disks To Include for the alert" - } - }, "AGWApplicationGatewayTotalTimeAlertSeverity": { "type": "String", "defaultValue": "2", @@ -4545,6 +4392,9 @@ }, "timeAggregation": { "value": "[[parameters('VMHeartBeatRGTimeAggregation')]" + }, + "failingPeriods": { + "value": "[[parameters('VMHeartBeatRGFailingPeriods')]" } } }, @@ -4594,9 +4444,6 @@ "computersToInclude": { "value": "[[parameters('VMNetworkInComputersToInclude')]" }, - "networkInterfacesToInclude": { - "value": "[[parameters('VMNetworkInNetworkInterfaceToInclude')]" - }, "alertResourceGroupName": { "value": "[[parameters('ALZMonitorResourceGroupName')]" }, @@ -4654,9 +4501,6 @@ "computersToInclude": { "value": "[[parameters('VMNetworkOutComputersToInclude')]" }, - "networkInterfacesToInclude": { - "value": "[[parameters('VMNetworkOutNetworkInterfaceToInclude')]" - }, "alertResourceGroupName": { "value": "[[parameters('ALZMonitorResourceGroupName')]" }, @@ -4714,9 +4558,6 @@ "computersToInclude": { "value": "[[parameters('VMOSDiskReadLatencyComputersToInclude')]" }, - "disksToInclude": { - "value": "[[parameters('VMOSDiskReadLatencyDisksToInclude')]" - }, "alertResourceGroupName": { "value": "[[parameters('ALZMonitorResourceGroupName')]" }, @@ -4774,9 +4615,6 @@ "computersToInclude": { "value": "[[parameters('VMOSDiskWriteLatencyComputersToInclude')]" }, - "disksToInclude": { - "value": "[[parameters('VMOSDiskWriteLatencyDisksToInclude')]" - }, "alertResourceGroupName": { "value": "[[parameters('ALZMonitorResourceGroupName')]" }, @@ -4834,9 +4672,6 @@ "computersToInclude": { "value": "[[parameters('VMOSDiskSpaceComputersToInclude')]" }, - "disksToInclude": { - "value": "[[parameters('VMOSDiskSpaceDisksToInclude')]" - }, "alertResourceGroupName": { "value": "[[parameters('ALZMonitorResourceGroupName')]" }, @@ -4885,6 +4720,9 @@ "timeAggregation": { "value": "[[parameters('VMPercentCPUTimeAggregation')]" }, + "failingPeriods": { + "value": "[[parameters('VMPercentCPUFailingPeriods')]" + }, "alertResourceGroupName": { "value": "[[parameters('ALZMonitorResourceGroupName')]" }, @@ -4987,9 +4825,6 @@ "evaluationPeriods": { "value": "[[parameters('VMDataDiskSpaceEvaluationPeriods')]" }, - "disksToInclude": { - "value": "[[parameters('VMDataDiskSpaceDisksToInclude')]" - }, "alertResourceGroupName": { "value": "[[parameters('ALZMonitorResourceGroupName')]" }, @@ -5047,9 +4882,6 @@ "computersToInclude": { "value": "[[parameters('VMDataDiskReadLatencyComputersToInclude')]" }, - "disksToInclude": { - "value": "[[parameters('VMDataDiskReadLatencyDisksToInclude')]" - }, "alertResourceGroupName": { "value": "[[parameters('ALZMonitorResourceGroupName')]" }, @@ -5107,9 +4939,6 @@ "computersToInclude": { "value": "[[parameters('VMDataDiskWriteLatencyComputersToInclude')]" }, - "disksToInclude": { - "value": "[[parameters('VMDataDiskWriteLatencyDisksToInclude')]" - }, "alertResourceGroupName": { "value": "[[parameters('ALZMonitorResourceGroupName')]" }, diff --git a/patterns/alz/policySetDefinitions/Deploy-LoadBalancing-Alerts.json b/patterns/alz/policySetDefinitions/Deploy-LoadBalancing-Alerts.json new file mode 100644 index 000000000..6e59afbc2 --- /dev/null +++ b/patterns/alz/policySetDefinitions/Deploy-LoadBalancing-Alerts.json @@ -0,0 +1,2444 @@ +{ + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "name": "Alerting-LoadBalancing", + "properties": { + "displayName": "Deploy Azure Monitor Baseline Alerts for Load Balancing", + "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Load Balancing Services such as Load Balancer, Application Gateway, Traffic Manager, and Azure Front Door.", + "metadata": { + "version": "1.0.0", + "category": "Monitoring", + "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", + "alzCloudEnvironments": [ + "AzureCloud" + ], + "_deployed_by_amba": true + }, + "parameters": { + "ALZMonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": "MonitorDisable" + }, + "ALZMonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] + }, + "PIPDDoSAttackAlertSeverity": { + "type": "String", + "defaultValue": "1", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "PIP DDoS Attack Alert Severity", + "description": "Severity of the alert for PIP DDoS Attack" + } + }, + "PIPDDoSAttackWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "PIP DDoS Attack Window Size", + "description": "Window size for the alert" + } + }, + "PIPDDoSAttackEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "PIP DDoS Attack Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "PIPDDoSAttackPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "PIP DDoS Attack Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "PIPDDoSAttackAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "PIP DDoS Attack Alert State", + "description": "Alert state for the alert" + } + }, + "PIPDDoSAttackThreshold": { + "type": "string", + "defaultValue": "0", + "metadata": { + "displayName": "PIP DDoS Attack Threshold", + "description": "Threshold for the alert" + } + }, + "PIPPacketsInDDoSAlertSeverity": { + "type": "String", + "defaultValue": "4", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "PIP Packets In DDoS Alert Severity", + "description": "Severity of the alert for PIP Packets In DDoS" + } + }, + "PIPPacketsInDDoSWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "PIP Packets In DDoS Window Size", + "description": "Window size for the alert" + } + }, + "PIPPacketsInDDoSEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "PIP Packets In DDoS Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "PIPPacketsInDDoSPolicyEffect": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "PIP Packets In DDoS Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "PIPPacketsInDDoSAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "PIP Packets In DDoS Alert State", + "description": "Alert state for the alert" + } + }, + "PIPPacketsInDDoSThreshold": { + "type": "string", + "defaultValue": "40000", + "metadata": { + "displayName": "PIP Packets In DDoS Threshold", + "description": "Threshold for the alert" + } + }, + "PIPVIPAvailabilityAlertSeverity": { + "type": "String", + "defaultValue": "1", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "PIP VIP Availability Alert Severity", + "description": "Severity of the alert for PIP VIP Availability" + } + }, + "PIPVIPAvailabilityWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "PIP VIP Availability Window Size", + "description": "Window size for the alert" + } + }, + "PIPVIPAvailabilityEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "PIP VIP Availability Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "PIPVIPAvailabilityPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "PIP VIP Availability Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "PIPVIPAvailabilityAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "PIP VIP Availability Alert State", + "description": "Alert state for the alert" + } + }, + "PIPVIPAvailabilityThreshold": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "PIP VIP Availability Threshold", + "description": "Threshold for the alert" + } + }, + "PIPBytesInDDoSAlertSeverity": { + "type": "String", + "defaultValue": "4", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "PIP Bytes In DDoS Alert Severity", + "description": "Severity of the alert for PIP Bytes In DDoS" + } + }, + "PIPBytesInDDoSWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "PIP Bytes In DDoS Window Size", + "description": "Window size for the alert" + } + }, + "PIPBytesInDDoSEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "PIP Bytes In DDoS Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "PIPBytesInDDoSPolicyEffect": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "PIP Bytes In DDoS Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "PIPBytesInDDoSAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "PIP Bytes In DDoS Alert State", + "description": "Alert state for the alert" + } + }, + "PIPBytesInDDoSThreshold": { + "type": "string", + "defaultValue": "8000000", + "metadata": { + "displayName": "PIP Bytes In DDoS Threshold", + "description": "Threshold for the alert" + } + }, + "VNETDDOSAttackAlertSeverity": { + "type": "String", + "defaultValue": "1", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "VNET DDoS Attack Alert Severity", + "description": "Severity of the alert for VNET DDoS Attack" + } + }, + "VNETDDOSAttackWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "VNET DDoS Attack Window Size", + "description": "Window size for the alert" + } + }, + "VNETDDOSAttackEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "VNET DDoS Attack Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VNETDDOSAttackPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "VNET DDoS Attack Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "VNETDDOSAttackAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VNET DDoS Attack Alert State", + "description": "Alert state for the alert" + } + }, + "VNETDDOSAttackThreshold": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VNET DDoS Attack Threshold", + "description": "Threshold for the alert" + } + }, + "AGWApplicationGatewayTotalTimeAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "AGW Total Time Alert Severity", + "description": "Severity of the alert" + } + }, + "AGWApplicationGatewayTotalTimeAlertSensitivity": { + "type": "String", + "defaultValue": "Medium", + "allowedValues": [ + "Low", + "Medium", + "High" + ], + "metadata": { + "displayName": "AGW Total Time Dynamic Alert Sensitivity", + "description": "Dynamic Sensitivity of the alert" + } + }, + "AGWApplicationGatewayTotalTimeWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "AGW Total Time Window Size", + "description": "Window size for the alert" + } + }, + "AGWApplicationGatewayTotalTimeEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "AGW Total Time Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "AGWApplicationGatewayTotalTimePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "AGW Total Time Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "AGWApplicationGatewayTotalTimeAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "AGW Total Time Alert State", + "description": "Alert state for the alert" + } + }, + "AGWBackendLastByteResponseTimeAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "AGW Backend Last Byte Response Time Alert Severity", + "description": "Severity of the alert" + } + }, + "AGWBackendLastByteResponseTimeAlertSensitivity": { + "type": "String", + "defaultValue": "Medium", + "allowedValues": [ + "Low", + "Medium", + "High" + ], + "metadata": { + "displayName": "AGW Backend Last Byte Response Time Dynamic Alert Sensitivity", + "description": "Dynamic Severity of the alert" + } + }, + "AGWBackendLastByteResponseTimeWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "AGW Backend Last Byte Response Time Window Size", + "description": "Window size for the alert" + } + }, + "AGWBackendLastByteResponseTimeEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "AGW Backend Last Byte Response Time Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "AGWBackendLastByteResponseTimePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "AGW Backend Last Byte Response Time Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "AGWBackendLastByteResponseTimeAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "AGW Backend Last Byte Response Time Alert State", + "description": "Alert state for the alert" + } + }, + "AGWCapacityUnitsAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "AGW Capacity Units Alert Severity", + "description": "Severity of the alert" + } + }, + "AGWCapacityUnitsWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "AGW Capacity Units Window Size", + "description": "Window size for the alert" + } + }, + "AGWCapacityUnitsEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "AGW Capacity Units Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "AGWCapacityUnitsPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "AGW Capacity Units Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "AGWCapacityUnitsAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "AGW Capacity Units Alert State", + "description": "Alert state for the alert" + } + }, + "AGWComputeUnitsAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "AGW Compute Units Alert Severity", + "description": "Severity of the alert" + } + }, + "AGWComputeUnitsWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "AGW Compute Units Window Size", + "description": "Window size for the alert" + } + }, + "AGWComputeUnitsEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "AGW Compute Units Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "AGWComputeUnitsPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "AGW Compute Units Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "AGWComputeUnitsAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "AGW Compute Units Alert State", + "description": "Alert state for the alert" + } + }, + "AGWCPUUtilAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "AGW CPU Util Alert Severity", + "description": "Severity of the alert" + } + }, + "AGWCPUUtilWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "AGW CPU Util Window Size", + "description": "Window size for the alert" + } + }, + "AGWCPUUtilEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "AGW CPU Util Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "AGWCPUUtilPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "AGW CPU Util Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "AGWCPUUtilAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "AGW CPU Util Alert State", + "description": "Alert state for the alert" + } + }, + "AGWFailedRequestsAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "AGW Failed Requests Alert Severity", + "description": "Severity of the alert" + } + }, + "AGWFailedRequestsAlertSensitivity": { + "type": "String", + "defaultValue": "Medium", + "allowedValues": [ + "Low", + "Medium", + "High" + ], + "metadata": { + "displayName": "AGW Failed Requests Dynamic Alert Sensitivity", + "description": "Dynamic Sensitivity of the alert" + } + }, + "AGWFailedRequestsWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "AGW Failed Requests Window Size", + "description": "Window size for the alert" + } + }, + "AGWFailedRequestsEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "AGW Failed Requests Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "AGWFailedRequestsPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "AGW Failed Requests Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "AGWFailedRequestsAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "AGW Failed Requests Alert State", + "description": "Alert state for the alert" + } + }, + "AGWResponseStatusAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "AGW Response Status Alert Severity", + "description": "Severity of the alert" + } + }, + "AGWResponseStatusAlertSensitivity": { + "type": "String", + "defaultValue": "Medium", + "allowedValues": [ + "Low", + "Medium", + "High" + ], + "metadata": { + "displayName": "AGW Response Status Dynamic Alert Sensitivity", + "description": "Dynamic Sensitivity of the alert" + } + }, + "AGWResponseStatusWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "AGW Response Status Window Size", + "description": "Window size for the alert" + } + }, + "AGWResponseStatusEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "AGW Response Status Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "AGWResponseStatusPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "AGW Response Status Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "AGWResponseStatusAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "AGW Response Status Alert State", + "description": "Alert state for the alert" + } + }, + "AGWUnhealthyHostCountAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "AGW Unhealthy Host Count Alert Severity", + "description": "Severity of the alert" + } + }, + "AGWUnhealthyHostCountWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "AGW Unhealthy Host Count Window Size", + "description": "Window size for the alert" + } + }, + "AGWUnhealthyHostCountEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "AGW Unhealthy Host Count Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "AGWUnhealthyHostCountPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "AGW Unhealthy Host Count Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "AGWUnhealthyHostCountAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "AGW Unhealthy Host Count Alert State", + "description": "Alert state for the alert" + } + }, + "LBDatapathAvailabilityAlertSeverity": { + "type": "String", + "defaultValue": "0", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "LB Data path Availability Alert Severity", + "description": "Severity of the alert" + } + }, + "LBDatapathAvailabilityWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "LB Data path Availability Window Size", + "description": "Window size for the alert" + } + }, + "LBDatapathAvailabilityEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "LB Data path Availability Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "LBDatapathAvailabilityPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "LB Data path Availability Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "LBDatapathAvailabilityAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "LB Data path Availability Alert State", + "description": "Alert state for the alert" + } + }, + "LBGlobalBackendAvailabilityAlertSeverity": { + "type": "String", + "defaultValue": "0", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "LB Global Backend Availability Alert Severity", + "description": "Severity of the alert" + } + }, + "LBGlobalBackendAvailabilityWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "LB Global Backend Availability Window Size", + "description": "Window size for the alert" + } + }, + "LBGlobalBackendAvailabilityEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "LB Global Backend Availability Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "LBGlobalBackendAvailabilityPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "LB Global Backend Availability Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "LBGlobalBackendAvailabilityAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "LB Global Backend Availability Alert State", + "description": "Alert state for the alert" + } + }, + "LBHealthProbeStatusAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "LB Health Probe Status Alert Severity", + "description": "Severity of the alert" + } + }, + "LBHealthProbeStatusWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "LB Health Probe Status Window Size", + "description": "Window size for the alert" + } + }, + "LBHealthProbeStatusEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "LB Health Probe Status Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "LBHealthProbeStatusPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "LB Health Probe Status Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "LBHealthProbeStatusAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "LB Health Probe Status Alert State", + "description": "Alert state for the alert" + } + }, + "LBUsedSNATPortsAlertSeverity": { + "type": "String", + "defaultValue": "1", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "LB Used SNAT Ports Alert Severity", + "description": "Severity of the alert" + } + }, + "LBUsedSNATPortsWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "LB Used SNAT Ports Window Size", + "description": "Window size for the alert" + } + }, + "LBUsedSNATPortsEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "LB Used SNAT Ports Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "LBUsedSNATPortsPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "LB Used SNAT Ports Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "LBUsedSNATPortsAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "LB Used SNAT Ports Alert State", + "description": "Alert state for the alert" + } + }, + "CDNPOriginHealthPercentageAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "CDN Origin Health Percentage Alert Severity", + "description": "Severity of the alert" + } + }, + "CDNPOriginHealthPercentageWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "CDN Origin Health Percentage Window Size", + "description": "Window size for the alert" + } + }, + "CDNPOriginHealthPercentageEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "CDN Origin Health Percentage Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "CDNPOriginHealthPercentagePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "CDN Origin Health Percentage Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "CDNPOriginHealthPercentageAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "CDN Origin Health Percentage Alert State", + "description": "Alert state for the alert" + } + }, + "CDNPOriginLatencyAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "CDN Origin Latancy Alert Severity", + "description": "Severity of the alert" + } + }, + "CDNPOriginLatencyWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "CDN Origin Latency Window Size", + "description": "Window size for the alert" + } + }, + "CDNPOriginLatencyEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "CDN Origin Latency Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "CDNPOriginLatencyPolicyEffect": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "CDN Origin Latency Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "CDNPOriginLatencyAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "CDN Origin Latency Alert State", + "description": "Alert state for the alert" + } + }, + "CDNPPercentage4XXAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "CDN Percentage 4XX Alert Severity", + "description": "Severity of the alert" + } + }, + "CDNPPercentage4XXWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "CDN Percentage 4XX Window Size", + "description": "Window size for the alert" + } + }, + "CDNPPercentage4XXEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "CDN Percentage 4XX Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "CDNPPercentage4XXPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "CDN Percentage 4XX Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "CDNPPercentage4XXAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "CDN Percentage 4XX Alert State", + "description": "Alert state for the alert" + } + }, + "CDNPPercentage5XXAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "CDN Percentage 5XX Alert Severity", + "description": "Severity of the alert" + } + }, + "CDNPPercentage5XXWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "CDN Percentage 5XX Window Size", + "description": "Window size for the alert" + } + }, + "CDNPPercentage5XXEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "CDN Percentage 5XX Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "CDNPPercentage5XXPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "CDN Percentage 5XX Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "CDNPPercentage5XXAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "CDN Percentage 5XX Alert State", + "description": "Alert state for the alert" + } + }, + "TMEndpointHealthAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "TM Enpoint Health Alert Severity", + "description": "Severity of the alert" + } + }, + "TMEndpointHealthWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "TM Enpoint Health Window Size", + "description": "Window size for the alert" + } + }, + "TMEndpointHealthEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "TM Enpoint Health Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "TMEndpointHealthPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "TM Enpoint Health Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "TMEndpointHealthAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "TM Enpoint Health Alert State", + "description": "Alert state for the alert" + } + }, + "FDBackendHealthAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "FD Backend Health Alert Severity", + "description": "Severity of the alert" + } + }, + "FDBackendHealthWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "FD Backend Health Window Size", + "description": "Window size for the alert" + } + }, + "FDBackendHealthEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "FD Backend Health Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "FDBackendHealthPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "FD Backend Health Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "FDBackendHealthAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "FD Backend Health Alert State", + "description": "Alert state for the alert" + } + }, + "FDBackendRequestLatencyAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "FD Backend Request Latency Alert Severity", + "description": "Severity of the alert" + } + }, + "FDBackendRequestLatencyWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "FD Backend Request Latency Window Size", + "description": "Window size for the alert" + } + }, + "FDBackendRequestLatencyEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "FD Backend Request Latency Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "FDBackendRequestLatencyPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "FD Backend Request Latency Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "FDBackendRequestLatencyAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "FD Backend Request Latency Alert State", + "description": "Alert state for the alert" + } + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "ALZ_PIPBytesInDDoS", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_PublicIp_BytesInDDoSAttack_Alert", + "parameters": { + "severity": { + "value": "[[parameters('PIPBytesInDDoSAlertSeverity')]" + }, + "windowSize": { + "value": "[[parameters('PIPBytesInDDoSWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('PIPBytesInDDoSEvaluationFrequency')]" + }, + "effect": { + "value": "[[parameters('PIPBytesInDDoSPolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('PIPBytesInDDoSAlertState')]" + }, + "threshold": { + "value": "[[parameters('PIPBytesInDDoSThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_PIPDDoSAttack", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_PublicIp_DDoSAttack_Alert", + "parameters": { + "severity": { + "value": "[[parameters('PIPDDoSAttackAlertSeverity')]" + }, + "windowSize": { + "value": "[[parameters('PIPDDoSAttackWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('PIPDDoSAttackEvaluationFrequency')]" + }, + "effect": { + "value": "[[parameters('PIPDDoSAttackPolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('PIPDDoSAttackAlertState')]" + }, + "threshold": { + "value": "[[parameters('PIPDDoSAttackThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_PIPPacketsInDDoS", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_PublicIp_PacketsInDDoSAttack_Alert", + "parameters": { + "severity": { + "value": "[[parameters('PIPPacketsInDDoSAlertSeverity')]" + }, + "windowSize": { + "value": "[[parameters('PIPPacketsInDDoSWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('PIPPacketsInDDoSEvaluationFrequency')]" + }, + "effect": { + "value": "[[parameters('PIPPacketsInDDoSPolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('PIPPacketsInDDoSAlertState')]" + }, + "threshold": { + "value": "[[parameters('PIPPacketsInDDoSThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_PIPVIPAvailability", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_PublicIp_VIPAvailability_Alert", + "parameters": { + "severity": { + "value": "[[parameters('PIPVIPAvailabilityAlertSeverity')]" + }, + "windowSize": { + "value": "[[parameters('PIPVIPAvailabilityWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('PIPVIPAvailabilityEvaluationFrequency')]" + }, + "effect": { + "value": "[[parameters('PIPVIPAvailabilityPolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('PIPVIPAvailabilityAlertState')]" + }, + "threshold": { + "value": "[[parameters('PIPVIPAvailabilityThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VNETDDOSAttack", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VNET_DDoSAttack_Alert", + "parameters": { + "severity": { + "value": "[[parameters('VNETDDOSAttackAlertSeverity')]" + }, + "windowSize": { + "value": "[[parameters('VNETDDOSAttackWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('VNETDDOSAttackEvaluationFrequency')]" + }, + "effect": { + "value": "[[parameters('VNETDDOSAttackPolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('VNETDDOSAttackAlertState')]" + }, + "threshold": { + "value": "[[parameters('VNETDDOSAttackThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_AGWTotalTime", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_AG_ApplicationGatewayTotalTime_Alert", + "parameters": { + "severity": { + "value": "[[parameters('AGWApplicationGatewayTotalTimeAlertSeverity')]" + }, + "alertSensitivity": { + "value": "[[parameters('AGWApplicationGatewayTotalTimeAlertSensitivity')]" + }, + "windowSize": { + "value": "[[parameters('AGWApplicationGatewayTotalTimeWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('AGWApplicationGatewayTotalTimeEvaluationFrequency')]" + }, + "effect": { + "value": "[[parameters('AGWApplicationGatewayTotalTimePolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('AGWApplicationGatewayTotalTimeAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_AGWBackendLastByteResponseTime", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_AG_BackendLastByteResponseTime_Alert", + "parameters": { + "severity": { + "value": "[[parameters('AGWBackendLastByteResponseTimeAlertSeverity')]" + }, + "alertSensitivity": { + "value": "[[parameters('AGWBackendLastByteResponseTimeAlertSensitivity')]" + }, + "windowSize": { + "value": "[[parameters('AGWBackendLastByteResponseTimeWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('AGWBackendLastByteResponseTimeEvaluationFrequency')]" + }, + "effect": { + "value": "[[parameters('AGWBackendLastByteResponseTimePolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('AGWBackendLastByteResponseTimeAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_AGWCapacityUnits", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_AG_CapacityUnits_Alert", + "parameters": { + "severity": { + "value": "[[parameters('AGWCapacityUnitsAlertSeverity')]" + }, + "windowSize": { + "value": "[[parameters('AGWCapacityUnitsWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('AGWCapacityUnitsEvaluationFrequency')]" + }, + "effect": { + "value": "[[parameters('AGWCapacityUnitsPolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('AGWCapacityUnitsAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_AGWComputeUnits", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_AG_ComputeUnits_Alert", + "parameters": { + "severity": { + "value": "[[parameters('AGWComputeUnitsAlertSeverity')]" + }, + "windowSize": { + "value": "[[parameters('AGWComputeUnitsWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('AGWComputeUnitsEvaluationFrequency')]" + }, + "effect": { + "value": "[[parameters('AGWComputeUnitsPolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('AGWComputeUnitsAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_AGWCPUUtilization", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_AG_CPUUtilization_Alert", + "parameters": { + "severity": { + "value": "[[parameters('AGWCPUUtilAlertSeverity')]" + }, + "windowSize": { + "value": "[[parameters('AGWCPUUtilWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('AGWCPUUtilEvaluationFrequency')]" + }, + "effect": { + "value": "[[parameters('AGWCPUUtilPolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('AGWCPUUtilAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_AGWFailedRequests", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_AG_FailedRequests_Alert", + "parameters": { + "severity": { + "value": "[[parameters('AGWFailedRequestsAlertSeverity')]" + }, + "alertSensitivity": { + "value": "[[parameters('AGWFailedRequestsAlertSensitivity')]" + }, + "windowSize": { + "value": "[[parameters('AGWFailedRequestsWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('AGWFailedRequestsEvaluationFrequency')]" + }, + "effect": { + "value": "[[parameters('AGWFailedRequestsPolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('AGWFailedRequestsAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_AGWResponseStatus", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_AG_ResponseStatus_Alert", + "parameters": { + "severity": { + "value": "[[parameters('AGWResponseStatusAlertSeverity')]" + }, + "alertSensitivity": { + "value": "[[parameters('AGWResponseStatusAlertSensitivity')]" + }, + "windowSize": { + "value": "[[parameters('AGWResponseStatusWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('AGWResponseStatusEvaluationFrequency')]" + }, + "effect": { + "value": "[[parameters('AGWResponseStatusPolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('AGWResponseStatusAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_AGWUnhealthyHostCount", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_AG_UnhealthyHostCount_Alert", + "parameters": { + "severity": { + "value": "[[parameters('AGWUnhealthyHostCountAlertSeverity')]" + }, + "windowSize": { + "value": "[[parameters('AGWUnhealthyHostCountWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('AGWUnhealthyHostCountEvaluationFrequency')]" + }, + "effect": { + "value": "[[parameters('AGWUnhealthyHostCountPolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('AGWUnhealthyHostCountAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_LBDataPathAvailability", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ALB_DataPathAvailability_Alert", + "parameters": { + "severity": { + "value": "[[parameters('LBDataPathAvailabilityAlertSeverity')]" + }, + "windowSize": { + "value": "[[parameters('LBDataPathAvailabilityWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('LBDataPathAvailabilityEvaluationFrequency')]" + }, + "effect": { + "value": "[[parameters('LBDataPathAvailabilityPolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('LBDataPathAvailabilityAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_LBGlobalBackendAvailability", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ALB_GlobalBackendAvailability_Alert", + "parameters": { + "severity": { + "value": "[[parameters('LBGlobalBackendAvailabilityAlertSeverity')]" + }, + "windowSize": { + "value": "[[parameters('LBGlobalBackendAvailabilityWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('LBGlobalBackendAvailabilityEvaluationFrequency')]" + }, + "effect": { + "value": "[[parameters('LBGlobalBackendAvailabilityPolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('LBGlobalBackendAvailabilityAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_LBHealthProbeStatus", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ALB_HealthProbeStatus_Alert", + "parameters": { + "severity": { + "value": "[[parameters('LBHealthProbeStatusAlertSeverity')]" + }, + "windowSize": { + "value": "[[parameters('LBHealthProbeStatusWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('LBHealthProbeStatusEvaluationFrequency')]" + }, + "effect": { + "value": "[[parameters('LBHealthProbeStatusPolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('LBHealthProbeStatusAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_LBUsedSNATPorts", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_ALB_UsedSNATPorts_Alert", + "parameters": { + "severity": { + "value": "[[parameters('LBUsedSNATPortsAlertSeverity')]" + }, + "windowSize": { + "value": "[[parameters('LBUsedSNATPortsWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('LBUsedSNATPortsEvaluationFrequency')]" + }, + "effect": { + "value": "[[parameters('LBUsedSNATPortsPolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('LBUsedSNATPortsAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_CDNPOriginHealthPercentage", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_FrontDoorCDN_OriginHealthPercentage_Alert", + "parameters": { + "severity": { + "value": "[[parameters('CDNPOriginHealthPercentageAlertSeverity')]" + }, + "windowSize": { + "value": "[[parameters('CDNPOriginHealthPercentageWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('CDNPOriginHealthPercentageEvaluationFrequency')]" + }, + "effect": { + "value": "[[parameters('CDNPOriginHealthPercentagePolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('CDNPOriginHealthPercentageAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_CDNPOriginLatency", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_FrontDoorCDN_OriginLatency_Alert", + "parameters": { + "severity": { + "value": "[[parameters('CDNPOriginLatencyAlertSeverity')]" + }, + "windowSize": { + "value": "[[parameters('CDNPOriginLatencyWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('CDNPOriginLatencyEvaluationFrequency')]" + }, + "effect": { + "value": "[[parameters('CDNPOriginLatencyPolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('CDNPOriginLatencyAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_CDNPPercentage4XX", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_FrontDoorCDN_Percentage4XX_Alert", + "parameters": { + "severity": { + "value": "[[parameters('CDNPPercentage4XXAlertSeverity')]" + }, + "windowSize": { + "value": "[[parameters('CDNPPercentage4XXWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('CDNPPercentage4XXEvaluationFrequency')]" + }, + "effect": { + "value": "[[parameters('CDNPPercentage4XXPolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('CDNPPercentage4XXAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_CDNPPercentage5XX", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_FrontDoorCDN_Percentage5XX_Alert", + "parameters": { + "severity": { + "value": "[[parameters('CDNPPercentage5XXAlertSeverity')]" + }, + "windowSize": { + "value": "[[parameters('CDNPPercentage5XXWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('CDNPPercentage5XXEvaluationFrequency')]" + }, + "effect": { + "value": "[[parameters('CDNPPercentage5XXPolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('CDNPPercentage5XXAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_TMEndpointHealth", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_TM_EndpointHealth_Alert", + "parameters": { + "severity": { + "value": "[[parameters('TMEndpointHealthAlertSeverity')]" + }, + "windowSize": { + "value": "[[parameters('TMEndpointHealthWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('TMEndpointHealthEvaluationFrequency')]" + }, + "effect": { + "value": "[[parameters('TMEndpointHealthPolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('TMEndpointHealthAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_FDBackendHealth", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_FD_BackendHealth_Alert", + "parameters": { + "severity": { + "value": "[[parameters('FDBackendHealthAlertSeverity')]" + }, + "windowSize": { + "value": "[[parameters('FDBackendHealthWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('FDBackendHealthEvaluationFrequency')]" + }, + "effect": { + "value": "[[parameters('FDBackendHealthPolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('FDBackendHealthAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_FDBackendRequestLatency", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_FD_BackendRequestLatency_Alert", + "parameters": { + "severity": { + "value": "[[parameters('FDBackendRequestLatencyAlertSeverity')]" + }, + "windowSize": { + "value": "[[parameters('FDBackendRequestLatencyWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('FDBackendRequestLatencyEvaluationFrequency')]" + }, + "effect": { + "value": "[[parameters('FDBackendRequestLatencyPolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('FDBackendRequestLatencyAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + } + ], + "policyType": "Custom", + "policyDefinitionGroups": null + } +} diff --git a/patterns/alz/policySetDefinitions/Deploy-Management-Alerts.json b/patterns/alz/policySetDefinitions/Deploy-Management-Alerts.json index e2d41d644..526521102 100644 --- a/patterns/alz/policySetDefinitions/Deploy-Management-Alerts.json +++ b/patterns/alz/policySetDefinitions/Deploy-Management-Alerts.json @@ -6,7 +6,7 @@ "displayName": "Deploy Azure Monitor Baseline Alerts for Management", "description": "Initiative to deploy AMBA alerts relevant to the ALZ Management management group", "metadata": { - "version": "1.0.3", + "version": "1.2.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -41,6 +41,50 @@ "description": "Location of the resource group" } }, + "ALZMonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": "MonitorDisable" + }, + "ALZMonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] + }, + "ALZUserAssignedManagedIdentityName": { + "type": "string", + "defaultValue": "id-AMBA-ARG-Reader-001", + "metadata": { + "description": "The name of the user assigned managed identity to be created for monitoring purpose.", + "displayName": "Name of the user assigned managed identity to be created." + } + }, + "ALZManagementSubscriptionId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "The subscription ID of the management subscription where the user assigned managed identity will be created." + } + }, + "BYOUserAssignedManagedIdentityResourceId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "The resource Id of the user assigned managed identity provided by the customer.", + "displayName": "Customer defined User Assigned managed Identity resource Id." + } + }, "AATotalJobAlertSeverity": { "type": "String", "defaultValue": "2", @@ -226,6 +270,18 @@ "description": "Alert state for the alert" } }, + "activityLAWDeletePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Activity Log Alert Delete Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will create the alert if it does not exist, disabled will not create the alert" + } + }, "activityLAWDeleteAlertState": { "type": "string", "defaultValue": "true", @@ -234,6 +290,18 @@ "description": "Alert state for the alert" } }, + "activityLAWKeyRegenPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "LAW Key Regen Alert Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will create the alert if it does not exist, disabled will not create the alert" + } + }, "activityLAWKeyRegenAlertState": { "type": "string", "defaultValue": "true", @@ -241,6 +309,143 @@ "displayName": "Activity Log Alert Key Regen Alert State", "description": "Alert state for the alert" } + }, + "LAWDailyCapLimitSeverity": { + "type": "String", + "metadata": { + "displayName": "Log Analytics Workspace Daily Cap Limit Reached Alert Severity", + "description": "Severity of the Alert" + }, + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "defaultValue": "2" + }, + "LAWDailyCapLimitOperator": { + "type": "String", + "metadata": { + "displayName": "Log Analytics Workspace Daily Cap Limit Reached Alert Operator" + }, + "allowedValues": [ + "GreaterThan", + "GreaterThanOrEqual" + ], + "defaultValue": "GreaterThan" + }, + "LAWDailyCapLimitTimeAggregation": { + "type": "String", + "metadata": { + "displayName": "Log Analytics Workspace Daily Cap Limit Reached Alert TimeAggregation" + }, + "allowedValues": [ + "Count" + ], + "defaultValue": "Count" + }, + "LAWDailyCapLimitWindowSize": { + "type": "String", + "metadata": { + "displayName": "Log Analytics Workspace Daily Cap Limit Reached Alert Window Size", + "description": "Window size for the alert" + }, + "allowedValues": [ + "PT1M", + "PT5M", + "PT10M", + "PT15M", + "PT30M", + "PT45M", + "PT1H", + "PT2H", + "PT3H", + "PT4H", + "PT5H", + "PT6H", + "P1D" + ], + "defaultValue": "P1D" + }, + "LAWDailyCapLimitEvaluationFrequency": { + "type": "String", + "metadata": { + "displayName": "Log Analytics Workspace Daily Cap Limit Reached Alert Evaluation Frequency", + "description": "Evaluation frequency for the alert" + }, + "allowedValues": [ + "PT5M", + "PT10M", + "PT15M", + "PT30M", + "PT45M", + "PT1H", + "PT2H", + "PT3H", + "PT4H", + "PT5H", + "PT6H", + "P1D" + ], + "defaultValue": "PT1H" + }, + "LAWDailyCapLimitAutoMitigate": { + "type": "String", + "metadata": { + "displayName": "Log Analytics Workspace Daily Cap Limit Reached Alert Auto Mitigate", + "description": "Auto Mitigate for the alert" + }, + "allowedValues": [ + "true", + "false" + ], + "defaultValue": "true" + }, + "LAWDailyCapLimitThreshold": { + "type": "String", + "metadata": { + "displayName": "Log Analytics Workspace Daily Cap Limit Reached Alert Threshold", + "description": "Threshold for the alert" + }, + "defaultValue": "0" + }, + "LAWDailyCapLimitFailingPeriods": { + "type": "String", + "metadata": { + "displayName": "Log Analytics Workspace Daily Cap Limit Reached Alert Failing Periods", + "description": "Number of failing periods before alert is fired" + }, + "defaultValue": "1" + }, + "LAWDailyCapLimitEvaluationPeriods": { + "type": "String", + "metadata": { + "displayName": "Log Analytics Workspace Daily Cap Limit Reached Alert Evaluation Periods", + "description": "The number of aggregated lookback points." + }, + "defaultValue": "1" + }, + "LAWDailyCapLimitPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Log Analytics Workspace Daily Cap Limit Reached Alert Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will create the alert if it does not exist, disabled will not create the alert" + } + }, + "LAWDailyCapLimitAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "ALog Analytics Workspace Daily Cap Limit Reached Alert State", + "description": "Alert state for the alert" + } } }, "policyDefinitions": [ @@ -248,6 +453,9 @@ "policyDefinitionReferenceId": "ALZ_activityLAWDelete", "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_LAWorkspace_Delete", "parameters": { + "effect": { + "value": "[[parameters('activityLAWDeletePolicyEffect')]" + }, "enabled": { "value": "[[parameters('activityLAWDeleteAlertState')]" }, @@ -259,6 +467,12 @@ }, "alertResourceGroupLocation": { "value": "[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -266,6 +480,9 @@ "policyDefinitionReferenceId": "ALZ_activityLAWKeyRegen", "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_LAWorkspace_KeyRegen", "parameters": { + "effect": { + "value": "[[parameters('activityLAWKeyRegenPolicyEffect')]" + }, "enabled": { "value": "[[parameters('activityLAWKeyRegenAlertState')]" }, @@ -277,6 +494,60 @@ }, "alertResourceGroupLocation": { "value": "[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_LAWorkspaceDailyCapLimitReached", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_LAWorkspace_DailyCapLimitReached_Alert", + "parameters": { + "UAMIResourceId": { + "value": "[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), concat('/subscriptions/', parameters('ALZManagementSubscriptionId'), '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('ALZUserAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" + }, + "severity": { + "value": "[[parameters('LAWDailyCapLimitSeverity')]" + }, + "operator": { + "value": "[[parameters('LAWDailyCapLimitOperator')]" + }, + "timeAggregation": { + "value": "[[parameters('LAWDailyCapLimitTimeAggregation')]" + }, + "windowSize": { + "value": "[[parameters('LAWDailyCapLimitWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('LAWDailyCapLimitEvaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[parameters('LAWDailyCapLimitAutoMitigate')]" + }, + "threshold": { + "value": "[[parameters('LAWDailyCapLimitThreshold')]" + }, + "failingPeriods": { + "value": "[[parameters('LAWDailyCapLimitFailingPeriods')]" + }, + "evaluationPeriods": { + "value": "[[parameters('LAWDailyCapLimitEvaluationPeriods')]" + }, + "effect": { + "value": "[[parameters('LAWDailyCapLimitPolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('LAWDailyCapLimitAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -301,6 +572,12 @@ }, "threshold": { "value": "[[parameters('AATotalJobAlertThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -310,6 +587,12 @@ "parameters": { "effect": { "value": "[[parameters('RVBackupHealthMonitorPolicyEffect')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -334,6 +617,12 @@ }, "threshold": { "value": "[[parameters('StorageAccountAvailabilityThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -355,6 +644,12 @@ }, "alertResourceGroupLocation": { "value": "[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } } diff --git a/patterns/alz/policySetDefinitions/Deploy-NetworkChanges-Alerts.json b/patterns/alz/policySetDefinitions/Deploy-NetworkChanges-Alerts.json new file mode 100644 index 000000000..5d0f842b7 --- /dev/null +++ b/patterns/alz/policySetDefinitions/Deploy-NetworkChanges-Alerts.json @@ -0,0 +1,165 @@ +{ + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "name": "Alerting-NetworkChanges", + "properties": { + "displayName": "Deploy Azure Monitor Baseline Alerts for Changes in Network Routing and Security", + "description": "This initiative implements Azure Monitor Baseline Alerts to monitor alterations in Network Routing and Security, such as modifications to Route Tables and the removal of Network Security Groups.", + "metadata": { + "version": "1.0.0", + "category": "Monitoring", + "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", + "alzCloudEnvironments": [ + "AzureCloud" + ], + "_deployed_by_amba": true + }, + "parameters": { + "ALZMonitorResourceGroupName": { + "type": "String", + "defaultValue": "ALZ-Monitoring-RG", + "metadata": { + "displayName": "ALZ Monitor Resource Group Name", + "description": "Name of the resource group where the ALZ Monitor resources will be deployed" + } + }, + "ALZMonitorResourceGroupTags": { + "type": "Object", + "defaultValue": { + "_deployed_by_alz_monitor": true + }, + "metadata": { + "displayName": "ALZ Monitor Resource Group Tags", + "description": "Tags for the resource group where the ALZ Monitor resources will be deployed" + } + }, + "ALZMonitorResourceGroupLocation": { + "type": "String", + "defaultValue": "centralus", + "metadata": { + "displayName": "ALZ Monitor Resource Group Location", + "description": "Location of the resource group where the ALZ Monitor resources will be deployed" + } + }, + "ALZMonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": "MonitorDisable" + }, + "ALZMonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] + }, + "activityNSGDeletePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Activity NSG Delete Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "activityNSGDeleteAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Activity NSG Delete Alert State", + "description": "Alert state for the alert" + } + }, + "activityUDRUpdatePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Activity UDR Update Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "activityUDRUpdateAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Activity UDR Update Alert State", + "description": "Alert state for the alert" + } + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "ALZ_activityNSGDelete", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_NSG_Delete", + "parameters": { + "effect": { + "value": "[[parameters('activityNSGDeletePolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('activityNSGDeleteAlertState')]" + }, + "alertResourceGroupName": { + "value": "[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_activityUDRUpdate", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_RouteTable_Update", + "parameters": { + "effect": { + "value": "[[parameters('activityUDRUpdatePolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('activityUDRUpdateAlertState')]" + }, + "alertResourceGroupName": { + "value": "[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + } + ], + "policyType": "Custom", + "policyDefinitionGroups": null + } +} diff --git a/patterns/alz/policySetDefinitions/Deploy-Notification-Assets.json b/patterns/alz/policySetDefinitions/Deploy-Notification-Assets.json index 267f3d126..f2ea921be 100644 --- a/patterns/alz/policySetDefinitions/Deploy-Notification-Assets.json +++ b/patterns/alz/policySetDefinitions/Deploy-Notification-Assets.json @@ -4,9 +4,9 @@ "name": "Notification-Assets", "properties": { "displayName": "Deploy Azure Monitor Baseline Alerts - Notification Assets", - "description": "Initiative to deploy AMBA Notification Assets", + "description": "This initiative deploys Notification Assets for Azure Monitor Baseline Alerts. This includes the setup of an Alert Processing Rule and an Action Group to manage notifications and actions, along with a Notification Suppression Rule to manage alert notifications, as well as a Notification Suppression Rule to control alert notifications.", "metadata": { - "version": "1.2.0", + "version": "1.3.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -42,12 +42,33 @@ } }, "ALZMonitorActionGroupEmail": { - "type": "String", + "type": "Array", "metadata": { "displayName": "Action Group Email Addresses", "description": "Email addresses to send alerts to" }, - "defaultValue": "" + "defaultValue": [] + }, + "ALZMonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": "MonitorDisable" + }, + "ALZMonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] }, "ALZLogicappResourceId": { "type": "String", @@ -66,28 +87,28 @@ "defaultValue": "" }, "ALZArmRoleId": { - "type": "String", + "type": "array", "metadata": { - "displayName": "Arm Role Id", - "description": "Arm Built-in Role Id for action group to send alerts to a subscription level, will only send to individual members of role" + "displayName": "Arm Role Ids", + "description": "Arm Built-in Role Ids for action group to send alerts to" }, - "defaultValue": "" + "defaultValue": [] }, "ALZEventHubResourceId": { - "type": "String", + "type": "array", "metadata": { - "displayName": "Event Hub resource id", - "description": "Event Hub resource id for action group to send alerts to" + "displayName": "Event Hub resource Ids", + "description": "Event Hub resource Ids for action group to send alerts to" }, - "defaultValue": "" + "defaultValue": [] }, "ALZWebhookServiceUri": { - "type": "String", + "type": "Array", "metadata": { - "displayName": "Webhook Service Uri", - "description": "Indicates the service uri of the webhook to send alerts to" + "displayName": "Webhook Service Uri(s)", + "description": "Indicates the service uri(s) of the webhook to send alerts to" }, - "defaultValue": "" + "defaultValue": [] }, "ALZFunctionResourceId": { "type": "String", @@ -106,12 +127,12 @@ "defaultValue": "" }, "BYOActionGroup": { - "type": "String", + "type": "array", "metadata": { - "displayName": "Customer defined Action Group Resource ID", - "description": "The Resource ID of an existing Action Group already deployed by the customer in his environment" + "displayName": "Customer defined Action Group Resource IDs", + "description": "The Resource IDs of existing Action Groups currently deployed in the environment." }, - "defaultValue": "" + "defaultValue": [] }, "BYOAlertProcessingRule": { "type": "String", @@ -165,6 +186,12 @@ }, "BYOAlertProcessingRule": { "value": "[[parameters('BYOAlertProcessingRule')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -180,6 +207,12 @@ }, "ALZMonitorResourceGroupLocation": { "value": "[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } } diff --git a/patterns/alz/policySetDefinitions/Deploy-RecoveryServices-Alerts.json b/patterns/alz/policySetDefinitions/Deploy-RecoveryServices-Alerts.json new file mode 100644 index 000000000..bbc8b8dd0 --- /dev/null +++ b/patterns/alz/policySetDefinitions/Deploy-RecoveryServices-Alerts.json @@ -0,0 +1,73 @@ +{ + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "name": "Alerting-RecoveryServices", + "properties": { + "displayName": "Deploy Azure Monitor Baseline Alerts for Recovery Services", + "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Recovery Services such as Azure Backup, and Azure Site Recovery.", + "metadata": { + "version": "1.0.0", + "category": "Monitoring", + "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", + "alzCloudEnvironments": [ + "AzureCloud" + ], + "_deployed_by_amba": true + }, + "parameters": { + "ALZMonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": "MonitorDisable" + }, + "ALZMonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] + }, + "RVBackupHealthMonitorPolicyEffect": { + "type": "string", + "defaultValue": "modify", + "allowedValues": [ + "modify", + "audit", + "disabled" + ], + "metadata": { + "displayName": "Recovery Vault Backup Health Monitor Policy Effect", + "description": "Policy effect for the alert, modify will modify the alert if it exists, or audit if it does not exist" + } + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "ALZ_RVBackupHealthMonitor", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_RecoveryVault_BackupHealthMonitor_Alert", + "parameters": { + "effect": { + "value": "[[parameters('RVBackupHealthMonitorPolicyEffect')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + } + ], + "policyType": "Custom", + "policyDefinitionGroups": null + } +} diff --git a/patterns/alz/policySetDefinitions/Deploy-ServiceHealth-Alerts.json b/patterns/alz/policySetDefinitions/Deploy-ServiceHealth-Alerts.json index 1ec8a511e..eb75ee5b3 100644 --- a/patterns/alz/policySetDefinitions/Deploy-ServiceHealth-Alerts.json +++ b/patterns/alz/policySetDefinitions/Deploy-ServiceHealth-Alerts.json @@ -4,9 +4,9 @@ "name": "Alerting-ServiceHealth", "properties": { "displayName": "Deploy Azure Monitor Baseline Alerts for Service Health", - "description": "Initiative to deploy AMBA Service Health alerts to Azure services", + "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Service Health Events such as Service issues, Planned maintenance, Health advisories, Security advisories, and Resource health.", "metadata": { - "version": "1.4.0", + "version": "1.5.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -41,6 +41,27 @@ "description": "Location of the resource group" } }, + "ALZMonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": "MonitorDisable" + }, + "ALZMonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] + }, "ResHlthUnhealthyAlertState": { "type": "string", "defaultValue": "true", @@ -141,17 +162,9 @@ "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" } }, - "MonitorDisable": { - "type": "string", - "defaultValue": "MonitorDisable", - "metadata": { - "displayName": "Monitoring disabled", - "description": "Tag name to disable monitoring. Set to true if monitoring should be disabled" - } - }, "ALZMonitorActionGroupEmail": { - "type": "string", - "defaultValue": "", + "type": "Array", + "defaultValue": [], "metadata": { "displayName": "Action Group Email Addresses", "description": "Email addresses to send alerts to" @@ -174,28 +187,28 @@ "defaultValue": "" }, "ALZArmRoleId": { - "type": "String", - "defaultValue": "", + "type": "array", + "defaultValue": [], "metadata": { - "displayName": "Arm Role Id", - "description": "Arm Built-in Role Id for action group to send alerts to a subscription level, will only send to individual members of role" + "displayName": "Arm Role Ids", + "description": "Arm Built-in Role Ids for action group to send alerts to" } }, "ALZEventHubResourceId": { - "type": "String", - "defaultValue": "", + "type": "array", + "defaultValue": [], "metadata": { - "displayName": "Event Hub resource id", - "description": "Event Hub resource id for action group to send alerts to" + "displayName": "Event Hub resource Ids", + "description": "Event Hub resource Ids for action group to send alerts to" } }, "ALZWebhookServiceUri": { - "type": "String", + "type": "Array", "metadata": { - "displayName": "Webhook Service Uri", - "description": "Indicates the service uri of the webhook to send alerts to" + "displayName": "Webhook Service Uri(s)", + "description": "Indicates the service uri(s) of the webhook to send alerts to" }, - "defaultValue": "" + "defaultValue": [] }, "ALZFunctionResourceId": { "type": "String", @@ -214,12 +227,12 @@ "defaultValue": "" }, "BYOActionGroup": { - "type": "String", + "type": "array", "metadata": { - "displayName": "Customer defined Action Group Resource ID", - "description": "The Resource ID of an existing Action Group already deployed by the customer in his environment" + "displayName": "Customer defined Action Group Resource IDs", + "description": "The Resource IDs of existing Action Groups currently deployed in the environment." }, - "defaultValue": "" + "defaultValue": [] }, "BYOAlertProcessingRule": { "type": "String", @@ -273,6 +286,12 @@ }, "BYOAlertProcessingRule": { "value": "[[parameters('BYOAlertProcessingRule')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -298,8 +317,11 @@ "BYOActionGroup": { "value": "[[parameters('BYOActionGroup')]" }, - "MonitorDisable": { - "value": "[[parameters('MonitorDisable')]" + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -328,8 +350,11 @@ "BYOActionGroup": { "value": "[[parameters('BYOActionGroup')]" }, - "MonitorDisable": { - "value": "[[parameters('MonitorDisable')]" + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -358,8 +383,11 @@ "BYOActionGroup": { "value": "[[parameters('BYOActionGroup')]" }, - "MonitorDisable": { - "value": "[[parameters('MonitorDisable')]" + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -388,8 +416,11 @@ "ALZMonitorActionGroupEmail": { "value": "[[parameters('ALZMonitorActionGroupEmail')]" }, - "MonitorDisable": { - "value": "[[parameters('MonitorDisable')]" + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } }, @@ -418,8 +449,11 @@ "BYOActionGroup": { "value": "[[parameters('BYOActionGroup')]" }, - "MonitorDisable": { - "value": "[[parameters('MonitorDisable')]" + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" } } } diff --git a/patterns/alz/policySetDefinitions/Deploy-Storage-Alerts.json b/patterns/alz/policySetDefinitions/Deploy-Storage-Alerts.json new file mode 100644 index 000000000..a6c3f7e9a --- /dev/null +++ b/patterns/alz/policySetDefinitions/Deploy-Storage-Alerts.json @@ -0,0 +1,224 @@ +{ + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "name": "Alerting-Storage", + "properties": { + "displayName": "Deploy Azure Monitor Baseline Alerts for Storage", + "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Storage Services such as Storage accounts.", + "metadata": { + "version": "1.0.0", + "category": "Monitoring", + "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", + "alzCloudEnvironments": [ + "AzureCloud" + ], + "_deployed_by_amba": true + }, + "parameters": { + "ALZMonitorResourceGroupName": { + "type": "String", + "defaultValue": "ALZ-Monitoring-RG", + "metadata": { + "displayName": "ALZ Monitor Resource Group Name", + "description": "Name of the resource group where the ALZ Monitor resources will be deployed" + } + }, + "ALZMonitorResourceGroupTags": { + "type": "Object", + "defaultValue": { + "_deployed_by_alz_monitor": true + }, + "metadata": { + "displayName": "ALZ Monitor Resource Group Tags", + "description": "Tags for the resource group where the ALZ Monitor resources will be deployed" + } + }, + "ALZMonitorResourceGroupLocation": { + "type": "String", + "defaultValue": "centralus", + "metadata": { + "displayName": "ALZ Monitor Resource Group Location", + "description": "Location of the resource group where the ALZ Monitor resources will be deployed" + } + }, + "ALZMonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": "MonitorDisable" + }, + "ALZMonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] + }, + "StorageAccountAvailabilityAlertSeverity": { + "type": "String", + "defaultValue": "1", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "Storage Account Availability Alert Severity", + "description": "Severity of the alert for Storage Account Availability" + } + }, + "StorageAccountAvailabilityWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "Storage Account Availability Window Size", + "description": "Window size for the alert" + } + }, + "StorageAccountAvailabilityFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "Storage Account Availability Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "StorageAccountAvailabilityPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Storage Account Availability Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "StorageAccountAvailabilityAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Storage Account Availability Alert State", + "description": "Alert state for the alert" + } + }, + "StorageAccountAvailabilityThreshold": { + "type": "string", + "defaultValue": "90", + "metadata": { + "displayName": "Storage Account Availability Threshold", + "description": "Threshold for the alert" + } + }, + "StorageAccountDeletePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "Storage Account Delete Alert Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will create the alert if it does not exist, disabled will not create the alert" + } + }, + "StorageAccountDeleteAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "Storage Account Delete Alert State", + "description": "Alert state for the alert" + } + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "ALZ_StorageAccountAvailability", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_StorageAccount_Availability_Alert", + "parameters": { + "severity": { + "value": "[[parameters('StorageAccountAvailabilityAlertSeverity')]" + }, + "windowSize": { + "value": "[[parameters('StorageAccountAvailabilityWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('StorageAccountAvailabilityFrequency')]" + }, + "effect": { + "value": "[[parameters('StorageAccountAvailabilityPolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('StorageAccountAvailabilityAlertState')]" + }, + "threshold": { + "value": "[[parameters('StorageAccountAvailabilityThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_activitySADelete", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_activitylog_StorageAccount_Delete", + "parameters": { + "effect": { + "value": "[[parameters('StorageAccountDeletePolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('StorageAccountDeleteAlertState')]" + }, + "alertResourceGroupName": { + "value": "[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + } + ], + "policyType": "Custom", + "policyDefinitionGroups": null + } +} diff --git a/patterns/alz/policySetDefinitions/Deploy-VM-Alerts.json b/patterns/alz/policySetDefinitions/Deploy-VM-Alerts.json new file mode 100644 index 000000000..7b0558381 --- /dev/null +++ b/patterns/alz/policySetDefinitions/Deploy-VM-Alerts.json @@ -0,0 +1,2393 @@ +{ + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "name": "Alerting-VM", + "properties": { + "displayName": "Deploy Azure Monitor Baseline Alerts for Virtual Machines", + "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Azure Virtual Machines.", + "metadata": { + "version": "1.0.0", + "category": "Monitoring", + "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", + "alzCloudEnvironments": [ + "AzureCloud" + ], + "_deployed_by_amba": true + }, + "parameters": { + "ALZMonitorResourceGroupName": { + "type": "String", + "defaultValue": "ALZ-Monitoring-RG", + "metadata": { + "displayName": "ALZ Monitor Resource Group Name", + "description": "Name of the resource group where the ALZ Monitor resources will be deployed" + } + }, + "ALZMonitorResourceGroupTags": { + "type": "Object", + "defaultValue": { + "_deployed_by_alz_monitor": true + }, + "metadata": { + "displayName": "ALZ Monitor Resource Group Tags", + "description": "Tags for the resource group where the ALZ Monitor resources will be deployed" + } + }, + "ALZMonitorResourceGroupLocation": { + "type": "String", + "defaultValue": "centralus", + "metadata": { + "displayName": "ALZ Monitor Resource Group Location", + "description": "Location of the resource group where the ALZ Monitor resources will be deployed" + } + }, + "ALZMonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": "MonitorDisable" + }, + "ALZMonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] + }, + "ALZUserAssignedManagedIdentityName": { + "type": "string", + "defaultValue": "id-AMBA-ARG-Reader-001", + "metadata": { + "description": "The name of the user assigned managed identity to be created for monitoring purpose.", + "displayName": "Name of the user assigned managed identity to be created." + } + }, + "ALZManagementSubscriptionId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "The subscription ID of the management subscription where the user assigned managed identity will be created." + } + }, + "BYOUserAssignedManagedIdentityResourceId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "The resource Id of the user assigned managed identity provided by the customer.", + "displayName": "Customer defined User Assigned managed Identity resource Id." + } + }, + "VMHeartBeatRGAlertSeverity": { + "type": "String", + "defaultValue": "1", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "VM Heart Beat RG Alert Severity", + "description": "Severity of the alert for VM Heart Beat RG" + } + }, + "VMHeartBeatRGWindowSize": { + "type": "string", + "defaultValue": "PT6H", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "VM Heart Beat RG Window Size", + "description": "Window size for the alert" + } + }, + "VMHeartBeatRGEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "VM Heart Beat RG Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VMHeartBeatRGAutoMitigate": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Heart Beat RG Auto Mitigate", + "description": "Auto Mitigate for the alert" + } + }, + "VMHeartBeatRGAutoResolve": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Heart Beat RG Auto Resolve", + "description": "Auto Resolve for the alert" + } + }, + "VMHeartBeatRGAutoResolveTime": { + "type": "string", + "defaultValue": "00:10:00", + "metadata": { + "displayName": "VM Heart Beat RG Auto Resolve Time", + "description": "Auto Resolve Time for the alert" + } + }, + "VMHeartBeatRGPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "VM Heart Beat RG Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "VMHeartBeatRGAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Heart Beat RG Alert State", + "description": "Alert state for the alert" + } + }, + "VMHeartBeatRGThreshold": { + "type": "string", + "defaultValue": "10", + "metadata": { + "displayName": "VM Heart Beat RG Threshold", + "description": "Threshold for the alert" + } + }, + "VMHeartBeatRGOperator": { + "type": "string", + "defaultValue": "GreaterThan", + "allowedValues": [ + "GreaterThan" + ], + "metadata": { + "displayName": "VM Heart Beat RG Operator", + "description": "Operator for the alert" + } + }, + "VMHeartBeatRGTimeAggregation": { + "type": "string", + "defaultValue": "Count", + "allowedValues": [ + "Count" + ], + "metadata": { + "displayName": "VM Heart Beat RG Time Aggregation", + "description": "Time Aggregation for the alert" + } + }, + "VMHeartBeatRGComputersToInclude": { + "type": "array", + "defaultValue": [ + "*" + ], + "metadata": { + "displayName": "VM Heart Beat RG Computers To Include", + "description": "Computers To Include for the alert" + } + }, + "VMHeartBeatRGFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM Heart Beat RG Failing Periods", + "description": "Failing Periods for the alert" + } + }, + "VMNetworkInAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "VM Network In Alert Severity", + "description": "Severity of the alert for VM Network In" + } + }, + "VMNetworkInWindowSize": { + "type": "string", + "defaultValue": "PT15M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "VM Network In Window Size", + "description": "Window size for the alert" + } + }, + "VMNetworkInEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "VM Network In Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VMNetworkInAutoMitigate": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Network In Auto Mitigate", + "description": "Auto Mitigate for the alert" + } + }, + "VMNetworkInAutoResolve": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Network In Auto Resolve", + "description": "Auto Resolve for the alert" + } + }, + "VMNetworkInAutoResolveTime": { + "type": "string", + "defaultValue": "00:10:00", + "metadata": { + "displayName": "VM Network In Auto Resolve Time", + "description": "Auto Resolve Time for the alert" + } + }, + "VMNetworkInPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "VM Network In Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "VMNetworkInAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Network In Alert State", + "description": "Alert state for the alert" + } + }, + "VMNetworkInThreshold": { + "type": "string", + "defaultValue": "10000000", + "metadata": { + "displayName": "VM Network In Threshold", + "description": "Threshold for the alert" + } + }, + "VMNetworkInOperator": { + "type": "string", + "defaultValue": "GreaterThan", + "allowedValues": [ + "GreaterThan" + ], + "metadata": { + "displayName": "VM Network In Operator", + "description": "Operator for the alert" + } + }, + "VMNetworkInTimeAggregation": { + "type": "string", + "defaultValue": "Count", + "allowedValues": [ + "Count" + ], + "metadata": { + "displayName": "VM Network In Time Aggregation", + "description": "Time Aggregation for the alert" + } + }, + "VMNetworkInEvaluationPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM Network In Evaluation Periods", + "description": "Evaluation Periods for the alert" + } + }, + "VMNetworkInFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM Network In Failing Periods", + "description": "Failing Periods for the alert" + } + }, + "VMNetworkInComputersToInclude": { + "type": "array", + "defaultValue": [ + "*" + ], + "metadata": { + "displayName": "VM Network In Computers To Include", + "description": "Computers To Include for the alert" + } + }, + "VMNetworkOutAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "VM Network Out Alert Severity", + "description": "Severity of the alert for VM Network Out" + } + }, + "VMNetworkOutWindowSize": { + "type": "string", + "defaultValue": "PT15M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "VM Network Out Window Size", + "description": "Window size for the alert" + } + }, + "VMNetworkOutEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "VM Network Out Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VMNetworkOutAutoMitigate": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Network Out Auto Mitigate", + "description": "Auto Mitigate for the alert" + } + }, + "VMNetworkOutAutoResolve": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Network Out Auto Resolve", + "description": "Auto Resolve for the alert" + } + }, + "VMNetworkOutAutoResolveTime": { + "type": "string", + "defaultValue": "00:10:00", + "metadata": { + "displayName": "VM Network Out Auto Resolve Time", + "description": "Auto Resolve Time for the alert" + } + }, + "VMNetworkOutPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "VM Network Out Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "VMNetworkOutAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Network Out Alert State", + "description": "Alert state for the alert, true will enable the alert, false will disable the alert" + } + }, + "VMNetworkOutThreshold": { + "type": "string", + "defaultValue": "10000000", + "metadata": { + "displayName": "VM Network Out Threshold", + "description": "Threshold for the alert" + } + }, + "VMNetworkOutOperator": { + "type": "string", + "defaultValue": "GreaterThan", + "allowedValues": [ + "GreaterThan" + ], + "metadata": { + "displayName": "VM Network Out Operator", + "description": "Operator for the alert" + } + }, + "VMNetworkOutTimeAggregation": { + "type": "string", + "defaultValue": "Count", + "allowedValues": [ + "Count" + ], + "metadata": { + "displayName": "VM Network Out Time Aggregation", + "description": "Time Aggregation for the alert" + } + }, + "VMNetworkOutEvaluationPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM Network Out Evaluation Periods", + "description": "Evaluation Periods for the alert" + } + }, + "VMNetworkOutFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM Network Out Failing Periods", + "description": "Failing Periods for the alert" + } + }, + "VMNetworkOutComputersToInclude": { + "type": "array", + "defaultValue": [ + "*" + ], + "metadata": { + "displayName": "VM Network Out Computers To Include", + "description": "Computers To Include for the alert" + } + }, + "VMOSDiskReadLatencyAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "VM OS Disk Read Latency Alert Severity", + "description": "Severity of the alert for VM OS Disk Read Latency" + } + }, + "VMOSDiskReadLatencyWindowSize": { + "type": "string", + "defaultValue": "PT15M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "VM OS Disk Read Latency Window Size", + "description": "Window size for the alert" + } + }, + "VMOSDiskReadLatencyEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "VM OS Disk Read Latency Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VMOSDiskReadLatencyAutoMitigate": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM OS Disk Read Latency Auto Mitigate", + "description": "Auto Mitigate for the alert" + } + }, + "VMOSDiskReadLatencyAutoResolve": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM OS Disk Read Latency Auto Resolve", + "description": "Auto Resolve for the alert" + } + }, + "VMOSDiskReadLatencyAutoResolveTime": { + "type": "string", + "defaultValue": "00:10:00", + "metadata": { + "displayName": "VM OS Disk Read Latency Auto Resolve Time", + "description": "Auto Resolve Time for the alert" + } + }, + "VMOSDiskReadLatencyPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "VM OS Disk Read Latency Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "VMOSDiskReadLatencyAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM OS Disk Read Latency Alert State", + "description": "Alert state for the alert, true will enable the alert, false will disable the alert" + } + }, + "VMOSDiskReadLatencyThreshold": { + "type": "string", + "defaultValue": "30", + "metadata": { + "displayName": "VM OS Disk Read Latency Threshold", + "description": "Threshold for the alert" + } + }, + "VMOSDiskReadLatencyOperator": { + "type": "string", + "defaultValue": "GreaterThan", + "allowedValues": [ + "GreaterThan" + ], + "metadata": { + "displayName": "VM OS Disk Read Latency Operator", + "description": "Operator for the alert" + } + }, + "VMOSDiskReadLatencyTimeAggregation": { + "type": "string", + "defaultValue": "Count", + "allowedValues": [ + "Count" + ], + "metadata": { + "displayName": "VM OS Disk Read Latency Time Aggregation", + "description": "Time Aggregation for the alert" + } + }, + "VMOSDiskReadLatencyEvaluationPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM OS Disk Read Latency Evaluation Periods", + "description": "Evaluation Periods for the alert" + } + }, + "VMOSDiskReadLatencyFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM OS Disk Read Latency Failing Periods", + "description": "Failing Periods for the alert" + } + }, + "VMOSDiskReadLatencyComputersToInclude": { + "type": "array", + "defaultValue": [ + "*" + ], + "metadata": { + "displayName": "VM OS Disk Read Latency Computers To Include", + "description": "Computers To Include for the alert" + } + }, + "VMOSDiskWriteLatencyAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "VM OS Disk Write Latency Alert Severity", + "description": "Severity of the alert for VM OS Disk Write Latency" + } + }, + "VMOSDiskWriteLatencyWindowSize": { + "type": "string", + "defaultValue": "PT15M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "VM OS Disk Write Latency Window Size", + "description": "Window size for the alert" + } + }, + "VMOSDiskWriteLatencyEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "VM OS Disk Write Latency Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VMOSDiskWriteLatencyAutoMitigate": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM OS Disk Write Latency Auto Mitigate", + "description": "Auto Mitigate for the alert" + } + }, + "VMOSDiskWriteLatencyAutoResolve": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM OS Disk Write Latency Auto Resolve", + "description": "Auto Resolve for the alert" + } + }, + "VMOSDiskWriteLatencyAutoResolveTime": { + "type": "string", + "defaultValue": "00:10:00", + "metadata": { + "displayName": "VM OS Disk Write Latency Auto Resolve Time", + "description": "Auto Resolve Time for the alert" + } + }, + "VMOSDiskWriteLatencyPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "VM OS Disk Write Latency Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "VMOSDiskWriteLatencyAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM OS Disk Write Latency Alert State", + "description": "Alert state for the alert, true will enable the alert, false will disable the alert" + } + }, + "VMOSDiskWriteLatencyThreshold": { + "type": "string", + "defaultValue": "30", + "metadata": { + "displayName": "VM OS Disk Write Latency Threshold", + "description": "Threshold for the alert" + } + }, + "VMOSDiskWriteLatencyOperator": { + "type": "string", + "defaultValue": "GreaterThan", + "allowedValues": [ + "GreaterThan" + ], + "metadata": { + "displayName": "VM OS Disk Write Latency Operator", + "description": "Operator for the alert" + } + }, + "VMOSDiskWriteLatencyTimeAggregation": { + "type": "string", + "defaultValue": "Count", + "allowedValues": [ + "Count" + ], + "metadata": { + "displayName": "VM OS Disk Write Latency Time Aggregation", + "description": "Time Aggregation for the alert" + } + }, + "VMOSDiskWriteLatencyEvaluationPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM OS Disk Write Latency Evaluation Periods", + "description": "Evaluation Periods for the alert" + } + }, + "VMOSDiskWriteLatencyFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM OS Disk Write Latency Failing Periods", + "description": "Failing Periods for the alert" + } + }, + "VMOSDiskWriteLatencyComputersToInclude": { + "type": "array", + "defaultValue": [ + "*" + ], + "metadata": { + "displayName": "VM OS Disk Write Latency Computers To Include", + "description": "Computers To Include for the alert" + } + }, + "VMOSDiskSpaceAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "VM OS Disk Space Alert Severity", + "description": "Severity of the alert for VM OS Disk Space" + } + }, + "VMOSDiskSpaceWindowSize": { + "type": "string", + "defaultValue": "PT15M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "VM OS Disk Space Window Size", + "description": "Window size for the alert" + } + }, + "VMOSDiskSpaceEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "VM OS Disk Space Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VMOSDiskSpaceAutoMitigate": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM OS Disk Space Auto Mitigate", + "description": "Auto Mitigate for the alert" + } + }, + "VMOSDiskSpaceAutoResolve": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM OS Disk Space Auto Resolve", + "description": "Auto Resolve for the alert" + } + }, + "VMOSDiskSpaceAutoResolveTime": { + "type": "string", + "defaultValue": "00:10:00", + "metadata": { + "displayName": "VM OS Disk Space Auto Resolve Time", + "description": "Auto Resolve Time for the alert" + } + }, + "VMOSDiskSpacePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "VM OS Disk Space Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "VMOSDiskSpaceAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM OS Disk Space Alert State", + "description": "Alert state for the alert, true will enable the alert, false will disable the alert" + } + }, + "VMOSDiskSpaceThreshold": { + "type": "string", + "defaultValue": "10", + "metadata": { + "displayName": "VM OS Disk Space Threshold", + "description": "Threshold for the alert" + } + }, + "VMOSDiskSpaceOperator": { + "type": "string", + "defaultValue": "GreaterThan", + "allowedValues": [ + "GreaterThan" + ], + "metadata": { + "displayName": "VM OS Disk Space Operator", + "description": "Operator for the alert" + } + }, + "VMOSDiskSpaceTimeAggregation": { + "type": "string", + "defaultValue": "Count", + "allowedValues": [ + "Count" + ], + "metadata": { + "displayName": "VM OS Disk Space Time Aggregation", + "description": "Time Aggregation for the alert" + } + }, + "VMOSDiskSpaceEvaluationPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM OS Disk Space Evaluation Periods", + "description": "Evaluation Periods for the alert" + } + }, + "VMOSDiskSpaceFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM OS Disk Space Failing Periods", + "description": "Failing Periods for the alert" + } + }, + "VMOSDiskSpaceComputersToInclude": { + "type": "array", + "defaultValue": [ + "*" + ], + "metadata": { + "displayName": "VM OS Disk Space Computers To Include", + "description": "Computers To Include for the alert" + } + }, + "VMPercentCPUAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "VM Percent CPU Alert Severity", + "description": "Severity of the alert for VM Percent CPU" + } + }, + "VMPercentCPUWindowSize": { + "type": "string", + "defaultValue": "PT15M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "VM Percent CPU Window Size", + "description": "Window size for the alert" + } + }, + "VMPercentCPUEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "VM Percent CPU Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VMPercentCPUAutoMitigate": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Percent CPU Auto Mitigate", + "description": "Auto Mitigate for the alert" + } + }, + "VMPercentCPUAutoResolve": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Percent CPU Auto Resolve", + "description": "Auto Resolve for the alert" + } + }, + "VMPercentCPUAutoResolveTime": { + "type": "string", + "defaultValue": "00:10:00", + "metadata": { + "displayName": "VM Percent CPU Auto Resolve Time", + "description": "Auto Resolve Time for the alert" + } + }, + "VMPercentCPUPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "VM Percent CPU Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "VMPercentCPUAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Percent CPU Alert State", + "description": "Alert state for the alert, true will enable the alert, false will disable the alert" + } + }, + "VMPercentCPUThreshold": { + "type": "string", + "defaultValue": "85", + "metadata": { + "displayName": "VM Percent CPU Threshold", + "description": "Threshold for the alert" + } + }, + "VMPercentCPUOperator": { + "type": "string", + "defaultValue": "GreaterThan", + "allowedValues": [ + "Equals", + "GreaterThan", + "GreaterThanOrEqual", + "LessThan", + "LessThanOrEqual" + ], + "metadata": { + "displayName": "VM Percent CPU Operator", + "description": "Operator for the alert" + } + }, + "VMPercentCPUTimeAggregation": { + "type": "string", + "defaultValue": "Count", + "allowedValues": [ + "Count" + ], + "metadata": { + "displayName": "VM Percent CPU Time Aggregation", + "description": "Time Aggregation for the alert" + } + }, + "VMPercentCPUFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM Percent CPU Failing Periods", + "description": "Failing Periods for the alert" + } + }, + "VMPercentMemoryAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "VM Percent Memory Alert Severity", + "description": "Severity of the alert for VM Percent Memory" + } + }, + "VMPercentMemoryWindowSize": { + "type": "string", + "defaultValue": "PT15M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "VM Percent Memory Window Size", + "description": "Window size for the alert" + } + }, + "VMPercentMemoryEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "VM Percent Memory Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VMPercentMemoryAutoMitigate": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Percent Memory Auto Mitigate", + "description": "Auto Mitigate for the alert" + } + }, + "VMPercentMemoryAutoResolve": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Percent Memory Auto Resolve", + "description": "Auto Resolve for the alert" + } + }, + "VMPercentMemoryAutoResolveTime": { + "type": "string", + "defaultValue": "00:10:00", + "metadata": { + "displayName": "VM Percent Memory Auto Resolve Time", + "description": "Auto Resolve Time for the alert" + } + }, + "VMPercentMemoryPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "VM Percent Memory Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "VMPercentMemoryAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Percent Memory Alert State", + "description": "Alert state for the alert, true will enable the alert, false will disable the alert" + } + }, + "VMPercentMemoryThreshold": { + "type": "string", + "defaultValue": "10", + "metadata": { + "displayName": "VM Percent Memory Threshold", + "description": "Threshold for the alert" + } + }, + "VMPercentMemoryOperator": { + "type": "string", + "defaultValue": "GreaterThan", + "allowedValues": [ + "GreaterThan" + ], + "metadata": { + "displayName": "VM Percent Memory Operator", + "description": "Operator for the alert" + } + }, + "VMPercentMemoryTimeAggregation": { + "type": "string", + "defaultValue": "Count", + "allowedValues": [ + "Count" + ], + "metadata": { + "displayName": "VM Percent Memory Time Aggregation", + "description": "Time Aggregation for the alert" + } + }, + "VMPercentMemoryFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM Percent Memory Failing Periods", + "description": "Failing Periods for the alert" + } + }, + "VMDataDiskSpaceAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "VM Data Disk Space Alert Severity", + "description": "Severity of the alert for VM Data Disk Space" + } + }, + "VMDataDiskSpaceWindowSize": { + "type": "string", + "defaultValue": "PT15M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "VM Data Disk Space Window Size", + "description": "Window size for the alert" + } + }, + "VMDataDiskSpaceEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "VM Data Disk Space Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VMDataDiskSpaceAutoMitigate": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Data Disk Space Auto Mitigate", + "description": "Auto Mitigate for the alert" + } + }, + "VMDataDiskSpaceAutoResolve": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Data Disk Space Auto Resolve", + "description": "Auto Resolve for the alert" + } + }, + "VMDataDiskSpaceAutoResolveTime": { + "type": "string", + "defaultValue": "00:10:00", + "metadata": { + "displayName": "VM Data Disk Space Auto Resolve Time", + "description": "Auto Resolve Time for the alert" + } + }, + "VMDataDiskSpacePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "VM Data Disk Space Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "VMDataDiskSpaceAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Data Disk Space Alert State", + "description": "Alert state for the alert, true will enable the alert, false will disable the alert" + } + }, + "VMDataDiskSpaceThreshold": { + "type": "string", + "defaultValue": "10", + "metadata": { + "displayName": "VM Data Disk Space Threshold", + "description": "Threshold for the alert" + } + }, + "VMDataDiskSpaceOperator": { + "type": "string", + "defaultValue": "GreaterThan", + "allowedValues": [ + "GreaterThan" + ], + "metadata": { + "displayName": "VM Data Disk Space Operator", + "description": "Operator for the alert" + } + }, + "VMDataDiskSpaceTimeAggregation": { + "type": "string", + "defaultValue": "Count", + "allowedValues": [ + "Count" + ], + "metadata": { + "displayName": "VM Data Disk Space Time Aggregation", + "description": "Time Aggregation for the alert" + } + }, + "VMDataDiskSpaceEvaluationPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM Data Disk Space Evaluation Periods", + "description": "Evaluation Periods for the alert" + } + }, + "VMDataDiskSpaceFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM Data Disk Space Failing Periods", + "description": "Failing Periods for the alert" + } + }, + "VMDataDiskSpaceComputersToInclude": { + "type": "array", + "defaultValue": [ + "*" + ], + "metadata": { + "displayName": "VM Data Disk Space Computers To Include", + "description": "Computers To Include for the alert" + } + }, + "VMDataDiskReadLatencyAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "VM Data Disk Read Latency Alert Severity", + "description": "Severity of the alert for VM Data Disk Read Latency" + } + }, + "VMDataDiskReadLatencyWindowSize": { + "type": "string", + "defaultValue": "PT15M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "VM Data Disk Read Latency Window Size", + "description": "Window size for the alert" + } + }, + "VMDataDiskReadLatencyEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "VM Data Disk Read Latency Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VMDataDiskReadLatencyAutoMitigate": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Data Disk Read Latency Auto Mitigate", + "description": "Auto Mitigate for the alert" + } + }, + "VMDataDiskReadLatencyAutoResolve": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Data Disk Read Latency Auto Resolve", + "description": "Auto Resolve for the alert" + } + }, + "VMDataDiskReadLatencyAutoResolveTime": { + "type": "string", + "defaultValue": "00:10:00", + "metadata": { + "displayName": "VM Data Disk Read Latency Auto Resolve Time", + "description": "Auto Resolve Time for the alert" + } + }, + "VMDataDiskReadLatencyPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "VM Data Disk Read Latency Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "VMDataDiskReadLatencyAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Data Disk Read Latency Alert State", + "description": "Alert state for the alert, true will enable the alert, false will disable the alert" + } + }, + "VMDataDiskReadLatencyThreshold": { + "type": "string", + "defaultValue": "30", + "metadata": { + "displayName": "VM Data Disk Read Latency Threshold", + "description": "Threshold for the alert" + } + }, + "VMDataDiskReadLatencyOperator": { + "type": "string", + "defaultValue": "GreaterThan", + "allowedValues": [ + "GreaterThan" + ], + "metadata": { + "displayName": "VM Data Disk Read Latency Operator", + "description": "Operator for the alert" + } + }, + "VMDataDiskReadLatencyTimeAggregation": { + "type": "string", + "defaultValue": "Count", + "allowedValues": [ + "Count" + ], + "metadata": { + "displayName": "VM Data Disk Read Latency Time Aggregation", + "description": "Time Aggregation for the alert" + } + }, + "VMDataDiskReadLatencyEvaluationPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM Data Disk Read Latency Evaluation Periods", + "description": "Evaluation Periods for the alert" + } + }, + "VMDataDiskReadLatencyFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM Data Disk Read Latency Failing Periods", + "description": "Failing Periods for the alert" + } + }, + "VMDataDiskReadLatencyComputersToInclude": { + "type": "array", + "defaultValue": [ + "*" + ], + "metadata": { + "displayName": "VM Data Disk Read Latency Computers To Include", + "description": "Computers To Include for the alert" + } + }, + "VMDataDiskWriteLatencyAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "VM Data Disk Write Latency Alert Severity", + "description": "Severity of the alert for VM Data Disk Write Latency" + } + }, + "VMDataDiskWriteLatencyWindowSize": { + "type": "string", + "defaultValue": "PT15M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "VM Data Disk Write Latency Window Size", + "description": "Window size for the alert" + } + }, + "VMDataDiskWriteLatencyEvaluationFrequency": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "VM Data Disk Write Latency Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "VMDataDiskWriteLatencyAutoMitigate": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Data Disk Write Latency Auto Mitigate", + "description": "Auto Mitigate for the alert" + } + }, + "VMDataDiskWriteLatencyAutoResolve": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Data Disk Write Latency Auto Resolve", + "description": "Auto Resolve for the alert" + } + }, + "VMDataDiskWriteLatencyAutoResolveTime": { + "type": "string", + "defaultValue": "00:10:00", + "metadata": { + "displayName": "VM Data Disk Write Latency Auto Resolve Time", + "description": "Auto Resolve Time for the alert" + } + }, + "VMDataDiskWriteLatencyPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "VM Data Disk Write Latency Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist" + } + }, + "VMDataDiskWriteLatencyAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "VM Data Disk Write Latency Alert State", + "description": "Alert state for the alert, true will enable the alert, false will disable the alert" + } + }, + "VMDataDiskWriteLatencyThreshold": { + "type": "string", + "defaultValue": "30", + "metadata": { + "displayName": "VM Data Disk Write Latency Threshold", + "description": "Threshold for the alert" + } + }, + "VMDataDiskWriteLatencyOperator": { + "type": "string", + "defaultValue": "GreaterThan", + "allowedValues": [ + "GreaterThan" + ], + "metadata": { + "displayName": "VM Data Disk Write Latency Operator", + "description": "Operator for the alert" + } + }, + "VMDataDiskWriteLatencyTimeAggregation": { + "type": "string", + "defaultValue": "Count", + "allowedValues": [ + "Count" + ], + "metadata": { + "displayName": "VM Data Disk Write Latency Time Aggregation", + "description": "Time Aggregation for the alert" + } + }, + "VMDataDiskWriteLatencyEvaluationPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM Data Disk Write Latency Evaluation Periods", + "description": "Evaluation Periods for the alert" + } + }, + "VMDataDiskWriteLatencyFailingPeriods": { + "type": "string", + "defaultValue": "1", + "metadata": { + "displayName": "VM Data Disk Write Latency Failing Periods", + "description": "Failing Periods for the alert" + } + }, + "VMDataDiskWriteLatencyComputersToInclude": { + "type": "array", + "defaultValue": [ + "*" + ], + "metadata": { + "displayName": "VM Data Disk Write Latency Computers To Include", + "description": "Computers To Include for the alert" + } + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "ALZ_VMHeartBeatRG", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VM_HeartBeat_Alert", + "parameters": { + "UAMIResourceId": { + "value": "[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), concat('/subscriptions/', parameters('ALZManagementSubscriptionId'), '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('ALZUserAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" + }, + "alertResourceGroupName": { + "value": "[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "severity": { + "value": "[[parameters('VMHeartBeatRGAlertSeverity')]" + }, + "windowSize": { + "value": "[[parameters('VMHeartBeatRGWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('VMHeartBeatRGEvaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[parameters('VMHeartBeatRGAutoMitigate')]" + }, + "autoResolve": { + "value": "[[parameters('VMHeartBeatRGAutoResolve')]" + }, + "autoResolveTime": { + "value": "[[parameters('VMHeartBeatRGAutoResolveTime')]" + }, + "effect": { + "value": "[[parameters('VMHeartBeatRGPolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('VMHeartBeatRGAlertState')]" + }, + "threshold": { + "value": "[[parameters('VMHeartBeatRGThreshold')]" + }, + "operator": { + "value": "[[parameters('VMHeartBeatRGOperator')]" + }, + "timeAggregation": { + "value": "[[parameters('VMHeartBeatRGTimeAggregation')]" + }, + "computersToInclude": { + "value": "[[parameters('VMHeartBeatRGComputersToInclude')]" + }, + "failingPeriods": { + "value": "[[parameters('VMHeartBeatRGFailingPeriods')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VMNetworkIn", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VM_NetworkIn_Alert", + "parameters": { + "UAMIResourceId": { + "value": "[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), concat('/subscriptions/', parameters('ALZManagementSubscriptionId'), '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('ALZUserAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" + }, + "severity": { + "value": "[[parameters('VMNetworkInAlertSeverity')]" + }, + "windowSize": { + "value": "[[parameters('VMNetworkInWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('VMNetworkInEvaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[parameters('VMNetworkInAutoMitigate')]" + }, + "autoResolve": { + "value": "[[parameters('VMNetworkInAutoResolve')]" + }, + "autoResolveTime": { + "value": "[[parameters('VMNetworkInAutoResolveTime')]" + }, + "effect": { + "value": "[[parameters('VMNetworkInPolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('VMNetworkInAlertState')]" + }, + "threshold": { + "value": "[[parameters('VMNetworkInThreshold')]" + }, + "operator": { + "value": "[[parameters('VMNetworkInOperator')]" + }, + "timeAggregation": { + "value": "[[parameters('VMNetworkInTimeAggregation')]" + }, + "failingPeriods": { + "value": "[[parameters('VMNetworkInFailingPeriods')]" + }, + "evaluationPeriods": { + "value": "[[parameters('VMNetworkInEvaluationPeriods')]" + }, + "computersToInclude": { + "value": "[[parameters('VMNetworkInComputersToInclude')]" + }, + "alertResourceGroupName": { + "value": "[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VMNetworkOut", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VM_NetworkOut_Alert", + "parameters": { + "UAMIResourceId": { + "value": "[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), concat('/subscriptions/', parameters('ALZManagementSubscriptionId'), '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('ALZUserAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" + }, + "severity": { + "value": "[[parameters('VMNetworkOutAlertSeverity')]" + }, + "windowSize": { + "value": "[[parameters('VMNetworkOutWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('VMNetworkOutEvaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[parameters('VMNetworkOutAutoMitigate')]" + }, + "autoResolve": { + "value": "[[parameters('VMNetworkOutAutoResolve')]" + }, + "autoResolveTime": { + "value": "[[parameters('VMNetworkOutAutoResolveTime')]" + }, + "effect": { + "value": "[[parameters('VMNetworkOutPolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('VMNetworkOutAlertState')]" + }, + "threshold": { + "value": "[[parameters('VMNetworkOutThreshold')]" + }, + "operator": { + "value": "[[parameters('VMNetworkOutOperator')]" + }, + "timeAggregation": { + "value": "[[parameters('VMNetworkOutTimeAggregation')]" + }, + "failingPeriods": { + "value": "[[parameters('VMNetworkOutFailingPeriods')]" + }, + "evaluationPeriods": { + "value": "[[parameters('VMNetworkOutEvaluationPeriods')]" + }, + "computersToInclude": { + "value": "[[parameters('VMNetworkOutComputersToInclude')]" + }, + "alertResourceGroupName": { + "value": "[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VMOSDiskReadLatency", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VM_OSDiskreadLatency_Alert", + "parameters": { + "UAMIResourceId": { + "value": "[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), concat('/subscriptions/', parameters('ALZManagementSubscriptionId'), '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('ALZUserAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" + }, + "severity": { + "value": "[[parameters('VMOSDiskReadLatencyAlertSeverity')]" + }, + "windowSize": { + "value": "[[parameters('VMOSDiskReadLatencyWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('VMOSDiskReadLatencyEvaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[parameters('VMOSDiskReadLatencyAutoMitigate')]" + }, + "autoResolve": { + "value": "[[parameters('VMOSDiskReadLatencyAutoResolve')]" + }, + "autoResolveTime": { + "value": "[[parameters('VMOSDiskReadLatencyAutoResolveTime')]" + }, + "effect": { + "value": "[[parameters('VMOSDiskReadLatencyPolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('VMOSDiskReadLatencyAlertState')]" + }, + "threshold": { + "value": "[[parameters('VMOSDiskReadLatencyThreshold')]" + }, + "operator": { + "value": "[[parameters('VMOSDiskReadLatencyOperator')]" + }, + "timeAggregation": { + "value": "[[parameters('VMOSDiskReadLatencyTimeAggregation')]" + }, + "failingPeriods": { + "value": "[[parameters('VMOSDiskReadLatencyFailingPeriods')]" + }, + "evaluationPeriods": { + "value": "[[parameters('VMOSDiskReadLatencyEvaluationPeriods')]" + }, + "computersToInclude": { + "value": "[[parameters('VMOSDiskReadLatencyComputersToInclude')]" + }, + "alertResourceGroupName": { + "value": "[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VMOSDiskWriteLatency", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VM_OSDiskwriteLatency_Alert", + "parameters": { + "UAMIResourceId": { + "value": "[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), concat('/subscriptions/', parameters('ALZManagementSubscriptionId'), '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('ALZUserAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" + }, + "severity": { + "value": "[[parameters('VMOSDiskWriteLatencyAlertSeverity')]" + }, + "windowSize": { + "value": "[[parameters('VMOSDiskWriteLatencyWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('VMOSDiskWriteLatencyEvaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[parameters('VMOSDiskWriteLatencyAutoMitigate')]" + }, + "autoResolve": { + "value": "[[parameters('VMOSDiskWriteLatencyAutoResolve')]" + }, + "autoResolveTime": { + "value": "[[parameters('VMOSDiskWriteLatencyAutoResolveTime')]" + }, + "effect": { + "value": "[[parameters('VMOSDiskWriteLatencyPolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('VMOSDiskWriteLatencyAlertState')]" + }, + "threshold": { + "value": "[[parameters('VMOSDiskWriteLatencyThreshold')]" + }, + "operator": { + "value": "[[parameters('VMOSDiskWriteLatencyOperator')]" + }, + "timeAggregation": { + "value": "[[parameters('VMOSDiskWriteLatencyTimeAggregation')]" + }, + "failingPeriods": { + "value": "[[parameters('VMOSDiskWriteLatencyFailingPeriods')]" + }, + "evaluationPeriods": { + "value": "[[parameters('VMOSDiskWriteLatencyEvaluationPeriods')]" + }, + "computersToInclude": { + "value": "[[parameters('VMOSDiskWriteLatencyComputersToInclude')]" + }, + "alertResourceGroupName": { + "value": "[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VMOSDiskSpace", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VM_OSDiskSpace_Alert", + "parameters": { + "UAMIResourceId": { + "value": "[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), concat('/subscriptions/', parameters('ALZManagementSubscriptionId'), '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('ALZUserAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" + }, + "severity": { + "value": "[[parameters('VMOSDiskSpaceAlertSeverity')]" + }, + "windowSize": { + "value": "[[parameters('VMOSDiskSpaceWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('VMOSDiskSpaceEvaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[parameters('VMOSDiskSpaceAutoMitigate')]" + }, + "autoResolve": { + "value": "[[parameters('VMOSDiskSpaceAutoResolve')]" + }, + "autoResolveTime": { + "value": "[[parameters('VMOSDiskSpaceAutoResolveTime')]" + }, + "effect": { + "value": "[[parameters('VMOSDiskSpacePolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('VMOSDiskSpaceAlertState')]" + }, + "threshold": { + "value": "[[parameters('VMOSDiskSpaceThreshold')]" + }, + "operator": { + "value": "[[parameters('VMOSDiskSpaceOperator')]" + }, + "timeAggregation": { + "value": "[[parameters('VMOSDiskSpaceTimeAggregation')]" + }, + "failingPeriods": { + "value": "[[parameters('VMOSDiskSpaceFailingPeriods')]" + }, + "evaluationPeriods": { + "value": "[[parameters('VMOSDiskSpaceEvaluationPeriods')]" + }, + "computersToInclude": { + "value": "[[parameters('VMOSDiskSpaceComputersToInclude')]" + }, + "alertResourceGroupName": { + "value": "[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VMPercentCPU", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VM_CPU_Alert", + "parameters": { + "UAMIResourceId": { + "value": "[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), concat('/subscriptions/', parameters('ALZManagementSubscriptionId'), '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('ALZUserAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" + }, + "severity": { + "value": "[[parameters('VMPercentCPUAlertSeverity')]" + }, + "windowSize": { + "value": "[[parameters('VMPercentCPUWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('VMPercentCPUEvaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[parameters('VMPercentCPUAutoMitigate')]" + }, + "autoResolve": { + "value": "[[parameters('VMPercentCPUAutoResolve')]" + }, + "autoResolveTime": { + "value": "[[parameters('VMPercentCPUAutoResolveTime')]" + }, + "effect": { + "value": "[[parameters('VMPercentCPUPolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('VMPercentCPUAlertState')]" + }, + "threshold": { + "value": "[[parameters('VMPercentCPUThreshold')]" + }, + "operator": { + "value": "[[parameters('VMPercentCPUOperator')]" + }, + "timeAggregation": { + "value": "[[parameters('VMPercentCPUTimeAggregation')]" + }, + "failingPeriods": { + "value": "[[parameters('VMPercentCPUFailingPeriods')]" + }, + "alertResourceGroupName": { + "value": "[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VMPercentMemory", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VM_Memory_Alert", + "parameters": { + "UAMIResourceId": { + "value": "[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), concat('/subscriptions/', parameters('ALZManagementSubscriptionId'), '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('ALZUserAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" + }, + "severity": { + "value": "[[parameters('VMPercentMemoryAlertSeverity')]" + }, + "windowSize": { + "value": "[[parameters('VMPercentMemoryWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('VMPercentMemoryEvaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[parameters('VMPercentMemoryAutoMitigate')]" + }, + "autoResolve": { + "value": "[[parameters('VMPercentMemoryAutoResolve')]" + }, + "autoResolveTime": { + "value": "[[parameters('VMPercentMemoryAutoResolveTime')]" + }, + "effect": { + "value": "[[parameters('VMPercentMemoryPolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('VMPercentMemoryAlertState')]" + }, + "threshold": { + "value": "[[parameters('VMPercentMemoryThreshold')]" + }, + "operator": { + "value": "[[parameters('VMPercentMemoryOperator')]" + }, + "timeAggregation": { + "value": "[[parameters('VMPercentMemoryTimeAggregation')]" + }, + "failingPeriods": { + "value": "[[parameters('VMPercentMemoryFailingPeriods')]" + }, + "alertResourceGroupName": { + "value": "[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VMDataDiskSpace", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VM_dataDiskSpace_Alert", + "parameters": { + "UAMIResourceId": { + "value": "[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), concat('/subscriptions/', parameters('ALZManagementSubscriptionId'), '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('ALZUserAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" + }, + "severity": { + "value": "[[parameters('VMDataDiskSpaceAlertSeverity')]" + }, + "windowSize": { + "value": "[[parameters('VMDataDiskSpaceWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('VMDataDiskSpaceEvaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[parameters('VMDataDiskSpaceAutoMitigate')]" + }, + "autoResolve": { + "value": "[[parameters('VMDataDiskSpaceAutoResolve')]" + }, + "autoResolveTime": { + "value": "[[parameters('VMDataDiskSpaceAutoResolveTime')]" + }, + "effect": { + "value": "[[parameters('VMDataDiskSpacePolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('VMDataDiskSpaceAlertState')]" + }, + "threshold": { + "value": "[[parameters('VMDataDiskSpaceThreshold')]" + }, + "operator": { + "value": "[[parameters('VMDataDiskSpaceOperator')]" + }, + "timeAggregation": { + "value": "[[parameters('VMDataDiskSpaceTimeAggregation')]" + }, + "failingPeriods": { + "value": "[[parameters('VMDataDiskSpaceFailingPeriods')]" + }, + "evaluationPeriods": { + "value": "[[parameters('VMDataDiskSpaceEvaluationPeriods')]" + }, + "computersToInclude": { + "value": "[[parameters('VMDataDiskSpaceComputersToInclude')]" + }, + "alertResourceGroupName": { + "value": "[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VMDataDiskReadLatency", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VM_dataDiskReadLatency_Alert", + "parameters": { + "UAMIResourceId": { + "value": "[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), concat('/subscriptions/', parameters('ALZManagementSubscriptionId'), '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('ALZUserAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" + }, + "severity": { + "value": "[[parameters('VMDataDiskReadLatencyAlertSeverity')]" + }, + "windowSize": { + "value": "[[parameters('VMDataDiskReadLatencyWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('VMDataDiskReadLatencyEvaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[parameters('VMDataDiskReadLatencyAutoMitigate')]" + }, + "autoResolve": { + "value": "[[parameters('VMDataDiskReadLatencyAutoResolve')]" + }, + "autoResolveTime": { + "value": "[[parameters('VMDataDiskReadLatencyAutoResolveTime')]" + }, + "effect": { + "value": "[[parameters('VMDataDiskReadLatencyPolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('VMDataDiskReadLatencyAlertState')]" + }, + "threshold": { + "value": "[[parameters('VMDataDiskReadLatencyThreshold')]" + }, + "operator": { + "value": "[[parameters('VMDataDiskReadLatencyOperator')]" + }, + "timeAggregation": { + "value": "[[parameters('VMDataDiskReadLatencyTimeAggregation')]" + }, + "failingPeriods": { + "value": "[[parameters('VMDataDiskReadLatencyFailingPeriods')]" + }, + "evaluationPeriods": { + "value": "[[parameters('VMDataDiskReadLatencyEvaluationPeriods')]" + }, + "computersToInclude": { + "value": "[[parameters('VMDataDiskReadLatencyComputersToInclude')]" + }, + "alertResourceGroupName": { + "value": "[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_VMDataDiskWriteLatency", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_VM_dataDiskWriteLatency_Alert", + "parameters": { + "UAMIResourceId": { + "value": "[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), concat('/subscriptions/', parameters('ALZManagementSubscriptionId'), '/resourceGroups/', parameters('ALZMonitorResourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('ALZUserAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" + }, + "severity": { + "value": "[[parameters('VMDataDiskWriteLatencyAlertSeverity')]" + }, + "windowSize": { + "value": "[[parameters('VMDataDiskWriteLatencyWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('VMDataDiskWriteLatencyEvaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[parameters('VMDataDiskWriteLatencyAutoMitigate')]" + }, + "autoResolve": { + "value": "[[parameters('VMDataDiskWriteLatencyAutoResolve')]" + }, + "autoResolveTime": { + "value": "[[parameters('VMDataDiskWriteLatencyAutoResolveTime')]" + }, + "effect": { + "value": "[[parameters('VMDataDiskWriteLatencyPolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('VMDataDiskWriteLatencyAlertState')]" + }, + "threshold": { + "value": "[[parameters('VMDataDiskWriteLatencyThreshold')]" + }, + "operator": { + "value": "[[parameters('VMDataDiskWriteLatencyOperator')]" + }, + "timeAggregation": { + "value": "[[parameters('VMDataDiskWriteLatencyTimeAggregation')]" + }, + "failingPeriods": { + "value": "[[parameters('VMDataDiskWriteLatencyFailingPeriods')]" + }, + "evaluationPeriods": { + "value": "[[parameters('VMDataDiskWriteLatencyEvaluationPeriods')]" + }, + "computersToInclude": { + "value": "[[parameters('VMDataDiskWriteLatencyComputersToInclude')]" + }, + "alertResourceGroupName": { + "value": "[[parameters('ALZMonitorResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[parameters('ALZMonitorResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[parameters('ALZMonitorResourceGroupLocation')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + } + ], + "policyType": "Custom", + "policyDefinitionGroups": null + } +} diff --git a/patterns/alz/policySetDefinitions/Deploy-Web-Alerts.json b/patterns/alz/policySetDefinitions/Deploy-Web-Alerts.json new file mode 100644 index 000000000..6cf3becfa --- /dev/null +++ b/patterns/alz/policySetDefinitions/Deploy-Web-Alerts.json @@ -0,0 +1,447 @@ +{ + "type": "Microsoft.Authorization/policySetDefinitions", + "apiVersion": "2021-06-01", + "name": "Alerting-Web", + "properties": { + "displayName": "Deploy Azure Monitor Baseline Alerts for Web", + "description": "This initiative deploys Azure Monitor Baseline Alerts to monitor Web Services such as App Services.", + "metadata": { + "version": "1.0.0", + "category": "Monitoring", + "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", + "alzCloudEnvironments": [ + "AzureCloud" + ], + "_deployed_by_amba": true + }, + "parameters": { + "ALZMonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": "MonitorDisable" + }, + "ALZMonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] + }, + "WSFCPUPercentageAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "WSF CPU Percentage Alert Severity", + "description": "Severity of the alert" + } + }, + "WSFCPUPercentageWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "WSF CPU Percentage Window Size", + "description": "Window size for the alert" + } + }, + "WSFCPUPercentageEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "WSF CPU Percentage Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "WSFCPUPercentagePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "WSF CPU Percentage Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "WSFCPUPercentageAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "WSF CPU Percentage Alert State", + "description": "Alert state for the alert" + } + }, + "WSFCPUPercentageThreshold": { + "type": "string", + "defaultValue": "90", + "metadata": { + "displayName": "WSF CPU Percentage Threshold", + "description": "Threshold for the alert" + } + }, + "WSFMemoryPercentageAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "WSF Memory Percentage Alert Severity", + "description": "Severity of the alert" + } + }, + "WSFMemoryPercentageWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "WSF Memory Percentage Window Size", + "description": "Window size for the alert" + } + }, + "WSFMemoryPercentageEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "WSF Memory Percentage Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "WSFMemoryPercentagePolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "WSF Memory Percentage Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "WSFMemoryPercentageAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "WSF Memory Percentage Alert State", + "description": "Alert state for the alert" + } + }, + "WSFMemoryPercentageThreshold": { + "type": "string", + "defaultValue": "85", + "metadata": { + "displayName": "WSF Memory Percentage Threshold", + "description": "Threshold for the alert" + } + }, + "WSFDiskQueueLengthAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "WSF Disk Queue Lenght Alert Severity", + "description": "Severity of the alert" + } + }, + "WSFDiskQueueLengthWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "WSF Disk Queue Lenght Window Size", + "description": "Window size for the alert" + } + }, + "WSFDiskQueueLengthEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "WSF Disk Queue Lenght Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "WSFDiskQueueLengthPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "WSF Disk Queue Lenght Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "WSFDiskQueueLengthAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "WSF Disk Queue Lenght Alert State", + "description": "Alert state for the alert" + } + }, + "WSFHttpQueueLengthAlertSeverity": { + "type": "String", + "defaultValue": "2", + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "metadata": { + "displayName": "WSF HTTP Queue Lenght Alert Severity", + "description": "Severity of the alert" + } + }, + "WSFHttpQueueLengthWindowSize": { + "type": "string", + "defaultValue": "PT5M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "metadata": { + "displayName": "WSF HTTP Queue Lenght Window Size", + "description": "Window size for the alert" + } + }, + "WSFHttpQueueLengthEvaluationFrequency": { + "type": "string", + "defaultValue": "PT1M", + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "metadata": { + "displayName": "WSF HTTP Queue Lenght Evaluation Frequency", + "description": "Evaluation frequency for the alert" + } + }, + "WSFHttpQueueLengthPolicyEffect": { + "type": "string", + "defaultValue": "deployIfNotExists", + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "metadata": { + "displayName": "WSF HTTP Queue Lenght Policy Effect", + "description": "Policy effect for the alert, deployIfNotExists will deploy the alert if it does not exist, disabled will not deploy the alert" + } + }, + "WSFHttpQueueLengthAlertState": { + "type": "string", + "defaultValue": "true", + "metadata": { + "displayName": "WSF HTTP Queue Lenght Alert State", + "description": "Alert state for the alert" + } + } + }, + "policyDefinitions": [ + { + "policyDefinitionReferenceId": "ALZ_WSFCPUPercentage", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_WSF_CPUPercentage_Alert", + "parameters": { + "severity": { + "value": "[[parameters('WSFCPUPercentageAlertSeverity')]" + }, + "windowSize": { + "value": "[[parameters('WSFCPUPercentageWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('WSFCPUPercentageEvaluationFrequency')]" + }, + "effect": { + "value": "[[parameters('WSFCPUPercentagePolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('WSFCPUPercentageAlertState')]" + }, + "threshold": { + "value": "[[parameters('WSFCPUPercentageThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_WSFMemoryPercentage", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_WSF_MemoryPercentage_Alert", + "parameters": { + "severity": { + "value": "[[parameters('WSFMemoryPercentageAlertSeverity')]" + }, + "windowSize": { + "value": "[[parameters('WSFMemoryPercentageWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('WSFMemoryPercentageEvaluationFrequency')]" + }, + "effect": { + "value": "[[parameters('WSFMemoryPercentagePolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('WSFMemoryPercentageAlertState')]" + }, + "threshold": { + "value": "[[parameters('WSFMemoryPercentageThreshold')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_WSFDiskQueueLength", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_WSF_DiskQueueLength_Alert", + "parameters": { + "severity": { + "value": "[[parameters('WSFDiskQueueLengthAlertSeverity')]" + }, + "windowSize": { + "value": "[[parameters('WSFDiskQueueLengthWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('WSFDiskQueueLengthEvaluationFrequency')]" + }, + "effect": { + "value": "[[parameters('WSFDiskQueueLengthPolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('WSFDiskQueueLengthAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + }, + { + "policyDefinitionReferenceId": "ALZ_WSFHttpQueueLength", + "policyDefinitionId": "/providers/Microsoft.Management/managementGroups/contoso/providers/Microsoft.Authorization/policyDefinitions/Deploy_WSF_HttpQueueLength_Alert", + "parameters": { + "severity": { + "value": "[[parameters('WSFHttpQueueLengthAlertSeverity')]" + }, + "windowSize": { + "value": "[[parameters('WSFHttpQueueLengthWindowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('WSFHttpQueueLengthEvaluationFrequency')]" + }, + "effect": { + "value": "[[parameters('WSFHttpQueueLengthPolicyEffect')]" + }, + "enabled": { + "value": "[[parameters('WSFHttpQueueLengthAlertState')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('ALZMonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('ALZMonitorDisableTagValues')]" + } + } + } + ], + "policyType": "Custom", + "policyDefinitionGroups": null + } +} diff --git a/patterns/alz/scripts/Start-AMBACleanup.ps1 b/patterns/alz/scripts/Start-AMBACleanup.ps1 index 0f01ccadb..42d674801 100644 --- a/patterns/alz/scripts/Start-AMBACleanup.ps1 +++ b/patterns/alz/scripts/Start-AMBACleanup.ps1 @@ -1,6 +1,6 @@ <# .SYNOPSIS - This script cleans up the resources deployed by the ALZ-Monitor automation, including alerts, policy assignments, policy definitions, and policy assignment role assignments. + This script cleans up the resources deployed by the ALZ-Monitor automation, including alerts, policy assignments, policy initiatives, policy definitions, and policy assignment role assignments. .DESCRIPTION .NOTES diff --git a/patterns/alz/scripts/Start-AMBAPolicyInitiativesAndAssignmentsCleanup.ps1 b/patterns/alz/scripts/Start-AMBAPolicyInitiativesAndAssignmentsCleanup.ps1 new file mode 100644 index 000000000..1920e748e --- /dev/null +++ b/patterns/alz/scripts/Start-AMBAPolicyInitiativesAndAssignmentsCleanup.ps1 @@ -0,0 +1,200 @@ +<# +.SYNOPSIS + This script cleans up the policy assignments, policy initiatives, policy definitions and policy assignment role assignments previously deployed. +.DESCRIPTION + +.NOTES + In order for this script to function the deployed resources must have a tag _deployed_by_amba with a value of true and Policy resources must have metadata property + named _deployed_by_amba with a value of True. These tags and metadata are included in the automation, but if they are subsequently removed, there may be orphaned + resources after this script executes. + + The Role Assignments associated with Policy assignment identities and including _deployed_by_amba in the description field will also be deleted. + + This script leverages the Azure Resource Graph to find object to delete. Note that the Resource Graph lags behind ARM by a couple minutes. +.LINK + https://github.com/Azure/azure-monitor-baseline-alerts + +.EXAMPLE + ./Start-AMBAPolicyInitiativesAndAssignmentsCleanup.ps1 -pseudoManagementGroup Contoso -ReportOnly + # generate a list of the resource IDs which would be deleted by this script + +.EXAMPLE + ./Start-AMBAPolicyInitiativesAndAssignmentsCleanup.ps1 -pseudoManagementGroup Contoso -WhatIf + # show output of what would happen if deletes executed + +.EXAMPLE + ./Start-AMBAPolicyInitiativesAndAssignmentsCleanup.ps1 -pseudoManagementGroup Contoso -Force + # delete all resources deployed by the ALZ-Monitor IaC without prompting for confirmation +#> + +[CmdletBinding(SupportsShouldProcess, ConfirmImpact = 'High')] +param( + # the pseudo managemnt group to start from + [Parameter(Mandatory = $True, + ValueFromPipeline = $false)] + [string]$pseudoRootManagementGroup, + # output a list of the resources to be deleted + [Parameter(Mandatory = $False, + ValueFromPipeline = $false)] + [switch]$reportOnly, + # if not specified, delete will prompt for confirmation + [Parameter(Mandatory = $False, + ValueFromPipeline = $false)] + [switch]$force +) + +Function Search-AzGraphRecursive { + # ensure query results with more than 100 resources and/or over more than 10 management groups are returned + param($query, $managementGroupNames, $skipToken) + + $optionalParams = @{} + If ($skipToken) { + $optionalParams += @{skipToken = $skipToken } + } + + # ARG will only query 10 management groups at a time--implement batching + If ($managementGroupNames.count -gt 10) { + $managementGroupBatches = @() + + For ($i = 0; $i -le $managementGroupNames.count; $i = $i + 10) { + $batchGroups = $managementGroupNames[$i..($i + 9)] + $managementGroupBatches += , @($batchGroups) + + If ($batchGroups.count -lt 10) { + continue + } + } + + $result = @() + ForEach ($managementGroupBatch in $managementGroupBatches) { + $batchResult = Search-AzGraph -Query $query -ManagementGroup $managementGroupBatch -Verbose:$false @optionalParams + + # resource graph returns pages of 100 resources, if there are more than 100 resources in a batch, recursively query for more + If ($batchResult.count -eq 100 -and $batchResult.SkipToken) { + $result += $batchResult + Search-AzGraphRecursive -query $query -managementGroupNames $managementGroupNames -skipToken $batchResult.SkipToken + } + else { + $result += $batchResult + } + } + } + Else { + $result = Search-AzGraph -Query $query -ManagementGroup $managementGroupNames -Verbose:$false @optionalParams + + If ($result.count -eq 100 -and $result.SkipToken) { + Search-AzGraphRecursive -query $query -managementGroupNames $managementGroupNames -skipToken $result.SkipToken + } + } + + $result +} + +Function Iterate-ManagementGroups($mg) { + + $script:managementGroups += $mg.Name + if ($mg.Children) { + foreach ($child in $mg.Children) { + if ($child.Type -eq 'Microsoft.Management/managementGroups') { + Iterate-ManagementGroups $child + } + } + } +} + +$ErrorActionPreference = 'Stop' + +If (-NOT(Get-Module -ListAvailable Az.Resources)) { + Write-Warning "This script requires the Az.Resources module." + + $response = Read-Host "Would you like to install the 'Az.Resources' module now? (y/n)" + If ($response -match '[yY]') { Install-Module Az.Resources -Scope CurrentUser } +} + +If (-NOT(Get-Module -ListAvailable Az.ResourceGraph)) { + Write-Warning "This script requires the Az.ResourceGraph module." + + $response = Read-Host "Would you like to install the 'Az.ResourceGraph' module now? (y/n)" + If ($response -match '[yY]') { Install-Module Az.ResourceGraph -Scope CurrentUser } +} + +If (-NOT(Get-Module -ListAvailable Az.ManagedServiceIdentity)) { + Write-Warning "This script requires the Az.ManagedServiceIdentity module." + + $response = Read-Host "Would you like to install the 'Az.ManagedServiceIdentity' module now? (y/n)" + If ($response -match '[yY]') { Install-Module Az.ManagedServiceIdentity -Scope CurrentUser } +} + +# get all management groups -- used in graph query scope +$managementGroups = @() +$allMgs = Get-AzManagementGroup -GroupName $pseudoRootManagementGroup -Expand -Recurse +foreach ($mg in $allMgs) { + Iterate-ManagementGroups $mg +} + +Write-Host "Found '$($managementGroups.Count)' management groups to query for ALZ-Monitor resources." + +If ($managementGroups.count -eq 0) { + Write-Error "The command 'Get-AzManagementGroups' returned '0' groups. This script needs to run with Owner permissions on the Azure Landing Zones intermediate root management group to effectively clean up Policies and all related resources." +} + +# get policy assignments to delete +$query = "policyresources | where type =~ 'microsoft.authorization/policyAssignments' | project name,metadata=parse_json(properties.metadata),type,identity,id | where metadata._deployed_by_amba =~ 'true'" +$policyAssignmentIds = Search-AzGraphRecursive -Query $query -ManagementGroupNames $managementGroups | Select-Object -ExpandProperty Id | Sort-Object | Get-Unique +Write-Host "Found '$($policyAssignmentIds.Count)' policy assignments with metadata '_deployed_by_amba=True' to be deleted." + +# get policy set definitions to delete +$query = "policyresources | where type =~ 'microsoft.authorization/policysetdefinitions' | project name,metadata=parse_json(properties.metadata),type,id | where metadata._deployed_by_amba =~ 'true' | project id" +$policySetDefinitionIds = Search-AzGraphRecursive -Query $query -ManagementGroupNames $managementGroups | Select-Object -ExpandProperty Id | Sort-Object | Get-Unique +Write-Host "Found '$($policySetDefinitionIds.Count)' policy set definitions with metadata '_deployed_by_amba=True' to be deleted." + +# get policy definitions to delete +$query = "policyresources | where type =~ 'microsoft.authorization/policyDefinitions' | project name,metadata=parse_json(properties.metadata),type,id | where metadata._deployed_by_amba =~ 'true' | project id" +$policyDefinitionIds = Search-AzGraphRecursive -Query $query -ManagementGroupNames $managementGroups | Select-Object -ExpandProperty Id | Sort-Object | Get-Unique +Write-Host "Found '$($policyDefinitionIds.Count)' policy definitions with metadata '_deployed_by_amba=True' to be deleted." + +# get role assignments to delete +$query = "authorizationresources | where type =~ 'microsoft.authorization/roleassignments' and properties.description == '_deployed_by_amba' | project roleDefinitionId = properties.roleDefinitionId, objectId = properties.principalId, scope = properties.scope, id" +$roleAssignments = Search-AzGraphRecursive -Query $query -ManagementGroupNames $managementGroups | Sort-Object -Property id | Get-Unique -AsString +Write-Host "Found '$($roleAssignments.Count)' role assignments with description '_deployed_by_amba' to be deleted." + +If (!$reportOnly.IsPresent) { + + Write-Warning "This script will delete the resources discovered above." + + If (!$force.IsPresent) { + While ($prompt -notmatch '[yYnN]') { + $prompt = Read-Host -Prompt 'Would you like to proceed with the deletion? (y/n)' + } + If ($prompt -match '[yY]') { + $force = $true + } + Else { + Write-Host "Exiting script..." + return + } + } + + # delete policy assignments + Write-Host "Deleting policy assignments..." + $policyAssignmentIds | ForEach-Object { Remove-AzPolicyAssignment -Id $_ -Confirm:(!$force) -ErrorAction Stop } + + # delete policy set definitions + Write-Host "Deleting policy set definitions..." + $policySetDefinitionIds | ForEach-Object { Remove-AzPolicySetDefinition -Id $_ -Force:$force -Confirm:(!$force) } + + # delete policy definitions + Write-Host "Deleting policy definitions..." + $policyDefinitionIds | ForEach-Object { Remove-AzPolicyDefinition -Id $_ -Force:$force -Confirm:(!$force) } + + # delete role assignments + Write-Host "Deleting role assignments..." + $roleAssignments | Select-Object -Property objectId, roleDefinitionId, scope | ForEach-Object { Remove-AzRoleAssignment @psItem -Confirm:(!$force) | Out-Null } + + Write-Host "Cleanup complete." +} +Else { + $resourceToBeDeleted = $policyAssignmentIds + $policySetDefinitionIds + $policyDefinitionIds + $roleAssignments.Id + + return $resourceToBeDeleted +} diff --git a/patterns/alz/scripts/Start-AMBARemediation.ps1 b/patterns/alz/scripts/Start-AMBARemediation.ps1 index 44ce207a1..9283a7599 100644 --- a/patterns/alz/scripts/Start-AMBARemediation.ps1 +++ b/patterns/alz/scripts/Start-AMBARemediation.ps1 @@ -1,25 +1,52 @@ <# -This script is used to trigger remediation on a specific policy or policy set at management group scope. -It first calls the Azure REST API to get the policy assignments in the management group scope, then it iterates through the policy assignments, checking by name whether it's a policy set or an individual policy. -Depending on the result the script will either enumerate the policy set and trigger remediation for each individual policy in the set or trigger remediation for the individual policy. - -Examples: - #Modify the following variables to match your environment - $pseudoRootManagementGroup = "The pseudo root management group id parenting the identity, management and connectivity management groups" - $identityManagementGroup = "The management group id for Identity" - $managementManagementGroup = "The management group id for Management" - $connectivityManagementGroup = "The management group id for Connectivity" - $LZManagementGroup="The management group id for Landing Zones" - - #Run the following commands to initiate remediation - .\patterns\alz\scripts\Start-AMBARemediation.ps1 -managementGroupName $managementManagementGroup -policyName Alerting-Management - .\patterns\alz\scripts\Start-AMBARemediation.ps1 -managementGroupName $connectivityManagementGroup -policyName Alerting-Connectivity - .\patterns\alz\scripts\Start-AMBARemediation.ps1 -managementGroupName $identityManagementGroup -policyName Alerting-Identity - .\patterns\alz\scripts\Start-AMBARemediation.ps1 -managementGroupName $LZManagementGroup -policyName Alerting-LandingZone - .\patterns\alz\scripts\Start-AMBARemediation.ps1 -managementGroupName $pseudoRootManagementGroup -policyName Alerting-ServiceHealth - .\patterns\alz\scripts\Start-AMBARemediation.ps1 -managementGroupName $pseudoRootManagementGroup -policyName Notification-Assets + .SYNOPSIS + Remediates Azure Policy Assignments + + .DESCRIPTION + This script is used to trigger remediation on a specific policy or policy set at management group scope. + It first calls the Azure REST API to get the policy assignments in the management group scope, then it iterates through the policy assignments, checking by name whether it's a policy set or an individual policy. + Depending on the result the script will either enumerate the policy set and trigger remediation for each individual policy in the set or trigger remediation for the individual policy. + + .PARAMETER managementGroupName + The management group name where the policy assignments are located. + + .PARAMETER policyName + The name of the policy or policy set to remediate. + + .EXAMPLE + Modify the following variables to match your environment: + + $pseudoRootManagementGroup = "The pseudo root management group id parenting the identity, management and connectivity management groups" + $identityManagementGroup = "The management group id for Identity" + $managementManagementGroup = "The management group id for Management" + $connectivityManagementGroup = "The management group id for Connectivity" + $LZManagementGroup = "The management group id for Landing Zones" + + Run the following commands to initiate remediation: + + .\patterns\alz\scripts\Start-AMBARemediation.ps1 -managementGroupName $pseudoRootManagementGroup -policyName Notification-Assets + .\patterns\alz\scripts\Start-AMBARemediation.ps1 -managementGroupName $pseudoRootManagementGroup -policyName Alerting-ServiceHealth + .\patterns\alz\scripts\Start-AMBARemediation.ps1 -managementGroupName $connectivityManagementGroup -policyName Alerting-Connectivity + .\patterns\alz\scripts\Start-AMBARemediation.ps1 -managementGroupName $identityManagementGroup -policyName Alerting-Identity + .\patterns\alz\scripts\Start-AMBARemediation.ps1 -managementGroupName $managementManagementGroup -policyName Alerting-Management + .\patterns\alz\scripts\Start-AMBARemediation.ps1 -managementGroupName $LZManagementGroup -policyName Alerting-KeyManagement + .\patterns\alz\scripts\Start-AMBARemediation.ps1 -managementGroupName $LZManagementGroup -policyName Alerting-LoadBalancing + .\patterns\alz\scripts\Start-AMBARemediation.ps1 -managementGroupName $LZManagementGroup -policyName Alerting-NetworkChanges + .\patterns\alz\scripts\Start-AMBARemediation.ps1 -managementGroupName $LZManagementGroup -policyName Alerting-HybridVM + .\patterns\alz\scripts\Start-AMBARemediation.ps1 -managementGroupName $LZManagementGroup -policyName Alerting-Storage + .\patterns\alz\scripts\Start-AMBARemediation.ps1 -managementGroupName $LZManagementGroup -policyName Alerting-VM + .\patterns\alz\scripts\Start-AMBARemediation.ps1 -managementGroupName $LZManagementGroup -policyName Alerting-Web + + .LINK + https://azure.github.io/azure-monitor-baseline-alerts/patterns/alz/deploy/Remediate-Policies/ #> +# The following SuppressMessageAttribute entries are used to surpress PSScriptAnalyzer tests against known exceptions as per: +# https://github.com/powershell/psscriptanalyzer#suppressing-rules +[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSReviewUnusedParameter', '', Justification = 'False positive')] +[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseDeclaredVarsMoreThanAssignments', '', Justification = 'False positive')] +[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseApprovedVerbs', '', Justification = 'Approved verbs are not available for this scenario')] + Param( [Parameter(Mandatory = $true)] [string] $managementGroupName, [Parameter(Mandatory = $true)] [string] $policyName @@ -85,24 +112,24 @@ function Get-PolicyType { Enumerate-Policy -managementGroupName $managementGroupName -policyAssignmentObject $PSItem } Else { - # Getting parent initiative for unassigned individual policies - If($initiatives) { - $parentInitiative = $initiatives.value | Where-Object {($_.properties.policyType -eq 'Custom') -and ($_.properties.metadata -like '*_deployed_by_amba*')} | Where-Object {$_.properties.policyDefinitions.policyDefinitionReferenceId -eq $policyname} - - # Getting the assignment of the parent initiative - If($parentInitiative) { - If($($PSItem.properties.policyDefinitionId) -match "/providers/Microsoft.Authorization/policySetDefinitions/$($parentInitiative.name)") { - # Invoking policy remediation - $assignmentFound = $true - Start-PolicyRemediation -managementGroupName $managementGroupName -policyAssignmentName $PSItem.name -polassignId $PSItem.id -policyDefinitionReferenceId $policyName - } + # Getting parent initiative for unassigned individual policies + If ($initiatives) { + $parentInitiative = $initiatives.value | Where-Object { ($_.properties.policyType -eq 'Custom') -and ($_.properties.metadata -like '*_deployed_by_amba*') } | Where-Object { $_.properties.policyDefinitions.policyDefinitionReferenceId -eq $policyname } + + # Getting the assignment of the parent initiative + If ($parentInitiative) { + If ($($PSItem.properties.policyDefinitionId) -match "/providers/Microsoft.Authorization/policySetDefinitions/$($parentInitiative.name)") { + # Invoking policy remediation + $assignmentFound = $true + Start-PolicyRemediation -managementGroupName $managementGroupName -policyAssignmentName $PSItem.name -polassignId $PSItem.id -policyDefinitionReferenceId $policyName + } + } } - } } } #if no policy assignments were found for the specified policy name, throw an error - If(!$assignmentFound) { + If (!$assignmentFound) { throw "No policy assignments found for policy $policyName at management group scope $managementGroupName" } } @@ -124,6 +151,12 @@ function Enumerate-PolicySet { $policySet $policies = $policySet.properties.policyDefinitions #iterate through the policies in the policy set + If ($policyAssignmentObject.properties.policyDefinitionId -match "/providers/Microsoft.Authorization/policySetDefinitions/Alerting-ServiceHealth") { + $policyDefinitionReferenceId = "Deploy_ServiceHealth_ActionGroups" + Start-PolicyRemediation -managementGroupName $managementGroupName -policyAssignmentName $name -polassignId $polassignId -policyDefinitionReferenceId $policyDefinitionReferenceId + Write-Host " Waiting for 5 minutes while remediating the 'Deploy Service Health Action Group' policy before continuing." -ForegroundColor Cyan + Start-Sleep -Seconds 360 + } Foreach ($policy in $policies) { $policyDefinitionId = $policy.policyDefinitionId $policyDefinitionReferenceId = $policy.policyDefinitionReferenceId @@ -145,19 +178,5 @@ function Enumerate-Policy { Start-PolicyRemediation -managementGroupName $managementGroupName -policyAssignmentName $name -polassignId $polassignId } - - #Main script - -# If remediating the Alerting-ServiceHealth initiative, we will remediate the ALZ_ServiceHealth_ActionGroups first, -# wait for 5 minutes and then remediate the entire Alerting-ServiceHealth initiative. -If($policyName -eq 'Alerting-ServiceHealth') { - Get-PolicyType -managementGroupName $managementGroupName -policyName 'ALZ_ServiceHealth_ActionGroups' - Write-Host " Waiting for 5 minutes while remediating the 'Deploy Service Health Action Group' policy before continuing." -ForegroundColor Cyan - Start-Sleep -Seconds 360 - Get-PolicyType -managementGroupName $managementGroupName -policyName $policyName -} -# Otherwise we just remediate everything passed in -Else { - Get-PolicyType -managementGroupName $managementGroupName -policyName $policyName -} +Get-PolicyType -managementGroupName $managementGroupName -policyName $policyName diff --git a/patterns/alz/templates/policies-Automation.bicep b/patterns/alz/templates/policies-Automation.bicep new file mode 100644 index 000000000..f282f5b8a --- /dev/null +++ b/patterns/alz/templates/policies-Automation.bicep @@ -0,0 +1,171 @@ +targetScope = 'managementGroup' + +@metadata({ message: 'The JSON version of this file is programatically generated from Bicep. PLEASE DO NOT UPDATE MANUALLY!!' }) +@description('Provide a prefix (unique at tenant-scope) for the Management Group hierarchy and other resources created as part of an Azure landing zone. DEFAULT VALUE = "alz"') +param topLevelManagementGroupPrefix string = 'alz' + +@description('Optionally set the deployment location for policies with Deploy If Not Exists effect. DEFAULT VALUE = "deployment().location"') +param location string = deployment().location + +@description('Optionally set the scope for custom Policy Definitions used in Policy Set Definitions (Initiatives). Must be one of \'/\', \'/subscriptions/id\' or \'/providers/Microsoft.Management/managementGroups/id\'. DEFAULT VALUE = \'/providers/Microsoft.Management/managementGroups/\${topLevelManagementGroupPrefix}\'') +param scope string = tenantResourceId('Microsoft.Management/managementGroups', topLevelManagementGroupPrefix) + +// Extract the environment name to dynamically determine which policies to deploy. +var cloudEnv = environment().name + +// Default deployment locations used in templates +var defaultDeploymentLocationByCloudType = { + AzureCloud: 'northeurope' + AzureChinaCloud: 'chinaeast2' + AzureUSGovernment: 'usgovvirginia' +} + +// Used to identify template variables used in the templates for replacement. +var templateVars = { + scope: '/providers/Microsoft.Management/managementGroups/contoso' + defaultDeploymentLocation: '"location": "northeurope"' + localizedDeploymentLocation: '"location": "${defaultDeploymentLocationByCloudType[cloudEnv]}"' +} + +var targetDeploymentLocationByCloudType = { + AzureCloud: location ?? 'northeurope' + AzureChinaCloud: location ?? 'chinaeast2' + AzureUSGovernment: location ?? 'usgovvirginia' +} + +var deploymentLocation = '"location": "${targetDeploymentLocationByCloudType[cloudEnv]}"' + +// Unable to do the following commented out approach due to the error "The value must be a compile-time constant.bicep(BCP032)" +// See: https://github.com/Azure/bicep/issues/3816#issuecomment-1191230215 + +// The following vars are used to load the list of Policy Definitions to import +// var listPolicyDefinitionsAll = loadJsonContent('../data/policyDefinitions.All.json') +// var listPolicyDefinitionsAzureCloud = loadJsonContent('../data/policyDefinitions.AzureCloud.json') +// var listPolicyDefinitionsAzureChinaCloud = loadJsonContent('../data/policyDefinitions.AzureChinaCloud.json') +// var listPolicyDefinitionsAzureUSGovernment = loadJsonContent('../data/policyDefinitions.AzureUSGovernment.json') + +// The following vars are used to load the list of Policy Set Definitions to import +// var listPolicySetDefinitionsAll = loadJsonContent('../data/policySetDefinitions.All.json') +// var listPolicySetDefinitionsAzureCloud = loadJsonContent('../data/policySetDefinitions.AzureCloud.json') +// var listPolicySetDefinitionsAzureChinaCloud = loadJsonContent('../data/policySetDefinitions.AzureChinaCloud.json') +// var listPolicySetDefinitionsAzureUSGovernment = loadJsonContent('../data/policySetDefinitions.AzureUSGovernment.json') + +// The following vars are used to load the list of Policy Definitions to import +// var loadPolicyDefinitionsAll = [for item in listPolicyDefinitionsAll: loadTextContent(item)] +// var loadPolicyDefinitionsAzureCloud = [for item in listPolicyDefinitionsAzureCloud: loadTextContent(item)] +// var loadPolicyDefinitionsAzureChinaCloud = [for item in listPolicyDefinitionsAzureChinaCloud: loadTextContent(item)] +// var loadPolicyDefinitionsAzureUSGovernment = [for item in listPolicyDefinitionsAzureUSGovernment: loadTextContent(item)] + +// The following vars are used to load the list of Policy Set Definitions to import +// var loadPolicySetDefinitionsAll = [for item in listPolicySetDefinitionsAll: loadTextContent(item)] +// var loadPolicySetDefinitionsAzureCloud = [for item in listPolicySetDefinitionsAzureCloud: loadTextContent(item)] +// var loadPolicySetDefinitionsAzureChinaCloud = [for item in listPolicySetDefinitionsAzureChinaCloud: loadTextContent(item)] +// var loadPolicySetDefinitionsAzureUSGovernment = [for item in listPolicySetDefinitionsAzureUSGovernment: loadTextContent(item)] + +// The following var contains lists of files containing Policy Definition resources to load, grouped by compatibility with Cloud. +// To get a full list of Azure clouds, use the az cli command "az cloud list --output table" +// We use loadTextContent instead of loadJsonContent as this allows us to perform string replacement operations against the imported templates. +var loadPolicyDefinitions = { + All: [ + // Used in Management Policy Set Definition only + loadTextContent('../../../services/Automation/automationAccounts/Deploy-AA-TotalJob-Alert.json') + ] + AzureCloud: [] + AzureChinaCloud: [] + AzureUSGovernment: [] +} + +// The following var contains lists of files containing Policy Set Definition (Initiative) resources to load, grouped by compatibility with Cloud. +// To get a full list of Azure clouds, use the az cli command "az cloud list --output table" +// We use loadTextContent instead of loadJsonContent as this allows us to perform string replacement operations against the imported templates. +// Use string(loadJsonContent('../file.json')) when the JSON has more than 131072 characters +var loadPolicySetDefinitions = { + All: [] + AzureCloud: [] + AzureChinaCloud: [] + AzureUSGovernment: [] +} + +// The following vars are used to manipulate the imported Policy Definitions to replace deployment location values +// Needs a double replace to handle updates in both templates for All clouds, and localized templates +var processPolicyDefinitionsAll = [for content in loadPolicyDefinitions.All: replace(replace(content, templateVars.defaultDeploymentLocation, deploymentLocation), templateVars.localizedDeploymentLocation, deploymentLocation)] +var processPolicyDefinitionsAzureCloud = [for content in loadPolicyDefinitions.AzureCloud: replace(replace(content, templateVars.defaultDeploymentLocation, deploymentLocation), templateVars.localizedDeploymentLocation, deploymentLocation)] +var processPolicyDefinitionsAzureChinaCloud = [for content in loadPolicyDefinitions.AzureChinaCloud: replace(replace(content, templateVars.defaultDeploymentLocation, deploymentLocation), templateVars.localizedDeploymentLocation, deploymentLocation)] +var processPolicyDefinitionsAzureUSGovernment = [for content in loadPolicyDefinitions.AzureUSGovernment: replace(replace(content, templateVars.defaultDeploymentLocation, deploymentLocation), templateVars.localizedDeploymentLocation, deploymentLocation)] + +// The following vars are used to manipulate the imported Policy Set Definitions to replace Policy Definition scope values +var processPolicySetDefinitionsAll = [for content in loadPolicySetDefinitions.All: replace(content, templateVars.scope, scope)] +var processPolicySetDefinitionsAzureCloud = [for content in loadPolicySetDefinitions.AzureCloud: replace(content, templateVars.scope, scope)] +var processPolicySetDefinitionsAzureChinaCloud = [for content in loadPolicySetDefinitions.AzureChinaCloud: replace(content, templateVars.scope, scope)] +var processPolicySetDefinitionsAzureUSGovernment = [for content in loadPolicySetDefinitions.AzureUSGovernment: replace(content, templateVars.scope, scope)] + +// The following vars are used to convert the imported Policy Definitions into objects from JSON +var policyDefinitionsAll = [for content in processPolicyDefinitionsAll: json(content)] +var policyDefinitionsAzureCloud = [for content in processPolicyDefinitionsAzureCloud: json(content)] +var policyDefinitionsAzureChinaCloud = [for content in processPolicyDefinitionsAzureChinaCloud: json(content)] +var policyDefinitionsAzureUSGovernment = [for content in processPolicyDefinitionsAzureUSGovernment: json(content)] + +// The following vars are used to convert the imported Policy Set Definitions into objects from JSON +var policySetDefinitionsAll = [for content in processPolicySetDefinitionsAll: json(content)] +var policySetDefinitionsAzureCloud = [for content in processPolicySetDefinitionsAzureCloud: json(content)] +var policySetDefinitionsAzureChinaCloud = [for content in processPolicySetDefinitionsAzureChinaCloud: json(content)] +var policySetDefinitionsAzureUSGovernment = [for content in processPolicySetDefinitionsAzureUSGovernment: json(content)] + +// The following var is used to compile the required Policy Definitions into a single object +var policyDefinitionsByCloudType = { + All: policyDefinitionsAll + AzureCloud: policyDefinitionsAzureCloud + AzureChinaCloud: policyDefinitionsAzureChinaCloud + AzureUSGovernment: policyDefinitionsAzureUSGovernment +} + +// The following var is used to compile the required Policy Definitions into a single object +var policySetDefinitionsByCloudType = { + All: policySetDefinitionsAll + AzureCloud: policySetDefinitionsAzureCloud + AzureChinaCloud: policySetDefinitionsAzureChinaCloud + AzureUSGovernment: policySetDefinitionsAzureUSGovernment +} + +// The following var is used to extract the Policy Definitions into a single list for deployment +// This will contain all policy definitions classified as available for All cloud environments, and those for the current cloud environment +var policyDefinitions = concat(policyDefinitionsByCloudType.All, policyDefinitionsByCloudType[cloudEnv]) + +// The following var is used to extract the Policy Set Definitions into a single list for deployment +// This will contain all policy set definitions classified as available for All cloud environments, and those for the current cloud environment +var policySetDefinitions = concat(policySetDefinitionsByCloudType.All, policySetDefinitionsByCloudType[cloudEnv]) + +// Create the Policy Definitions as needed for the target cloud environment +resource PolicyDefinitions 'Microsoft.Authorization/policyDefinitions@2020-09-01' = [for policy in policyDefinitions: { + name: policy.name + properties: { + description: policy.properties.description + displayName: policy.properties.displayName + metadata: policy.properties.metadata + mode: policy.properties.mode + parameters: policy.properties.parameters + policyType: policy.properties.policyType + policyRule: policy.properties.policyRule + } +}] + +// Create the Policy Definitions as needed for the target cloud environment +// Depends on Policy Definitons to ensure they exist before creating dependent Policy Set Definitions (Initiatives) +resource PolicySetDefinitions 'Microsoft.Authorization/policySetDefinitions@2020-09-01' = [for policy in policySetDefinitions: { + dependsOn: [ + PolicyDefinitions + ] + name: policy.name + properties: { + description: policy.properties.description + displayName: policy.properties.displayName + metadata: policy.properties.metadata + parameters: policy.properties.parameters + policyType: policy.properties.policyType + policyDefinitions: policy.properties.policyDefinitions + policyDefinitionGroups: policy.properties.policyDefinitionGroups + } +}] + +output policyDefinitionNames array = [for policy in policyDefinitions: policy.name] +output policySetDefinitionNames array = [for policy in policySetDefinitions: policy.name] diff --git a/patterns/alz/templates/policies-Compute.bicep b/patterns/alz/templates/policies-Compute.bicep new file mode 100644 index 000000000..142e1bb45 --- /dev/null +++ b/patterns/alz/templates/policies-Compute.bicep @@ -0,0 +1,183 @@ +targetScope = 'managementGroup' + +@metadata({ message: 'The JSON version of this file is programatically generated from Bicep. PLEASE DO NOT UPDATE MANUALLY!!' }) +@description('Provide a prefix (unique at tenant-scope) for the Management Group hierarchy and other resources created as part of an Azure landing zone. DEFAULT VALUE = "alz"') +param topLevelManagementGroupPrefix string = 'alz' + +@description('Optionally set the deployment location for policies with Deploy If Not Exists effect. DEFAULT VALUE = "deployment().location"') +param location string = deployment().location + +@description('Optionally set the scope for custom Policy Definitions used in Policy Set Definitions (Initiatives). Must be one of \'/\', \'/subscriptions/id\' or \'/providers/Microsoft.Management/managementGroups/id\'. DEFAULT VALUE = \'/providers/Microsoft.Management/managementGroups/\${topLevelManagementGroupPrefix}\'') +param scope string = tenantResourceId('Microsoft.Management/managementGroups', topLevelManagementGroupPrefix) + +// Extract the environment name to dynamically determine which policies to deploy. +var cloudEnv = environment().name + +// Default deployment locations used in templates +var defaultDeploymentLocationByCloudType = { + AzureCloud: 'northeurope' + AzureChinaCloud: 'chinaeast2' + AzureUSGovernment: 'usgovvirginia' +} + +// Used to identify template variables used in the templates for replacement. +var templateVars = { + scope: '/providers/Microsoft.Management/managementGroups/contoso' + defaultDeploymentLocation: '"location": "northeurope"' + localizedDeploymentLocation: '"location": "${defaultDeploymentLocationByCloudType[cloudEnv]}"' +} + +var targetDeploymentLocationByCloudType = { + AzureCloud: location ?? 'northeurope' + AzureChinaCloud: location ?? 'chinaeast2' + AzureUSGovernment: location ?? 'usgovvirginia' +} + +var deploymentLocation = '"location": "${targetDeploymentLocationByCloudType[cloudEnv]}"' + +// Unable to do the following commented out approach due to the error "The value must be a compile-time constant.bicep(BCP032)" +// See: https://github.com/Azure/bicep/issues/3816#issuecomment-1191230215 + +// The following vars are used to load the list of Policy Definitions to import +// var listPolicyDefinitionsAll = loadJsonContent('../data/policyDefinitions.All.json') +// var listPolicyDefinitionsAzureCloud = loadJsonContent('../data/policyDefinitions.AzureCloud.json') +// var listPolicyDefinitionsAzureChinaCloud = loadJsonContent('../data/policyDefinitions.AzureChinaCloud.json') +// var listPolicyDefinitionsAzureUSGovernment = loadJsonContent('../data/policyDefinitions.AzureUSGovernment.json') + +// The following vars are used to load the list of Policy Set Definitions to import +// var listPolicySetDefinitionsAll = loadJsonContent('../data/policySetDefinitions.All.json') +// var listPolicySetDefinitionsAzureCloud = loadJsonContent('../data/policySetDefinitions.AzureCloud.json') +// var listPolicySetDefinitionsAzureChinaCloud = loadJsonContent('../data/policySetDefinitions.AzureChinaCloud.json') +// var listPolicySetDefinitionsAzureUSGovernment = loadJsonContent('../data/policySetDefinitions.AzureUSGovernment.json') + +// The following vars are used to load the list of Policy Definitions to import +// var loadPolicyDefinitionsAll = [for item in listPolicyDefinitionsAll: loadTextContent(item)] +// var loadPolicyDefinitionsAzureCloud = [for item in listPolicyDefinitionsAzureCloud: loadTextContent(item)] +// var loadPolicyDefinitionsAzureChinaCloud = [for item in listPolicyDefinitionsAzureChinaCloud: loadTextContent(item)] +// var loadPolicyDefinitionsAzureUSGovernment = [for item in listPolicyDefinitionsAzureUSGovernment: loadTextContent(item)] + +// The following vars are used to load the list of Policy Set Definitions to import +// var loadPolicySetDefinitionsAll = [for item in listPolicySetDefinitionsAll: loadTextContent(item)] +// var loadPolicySetDefinitionsAzureCloud = [for item in listPolicySetDefinitionsAzureCloud: loadTextContent(item)] +// var loadPolicySetDefinitionsAzureChinaCloud = [for item in listPolicySetDefinitionsAzureChinaCloud: loadTextContent(item)] +// var loadPolicySetDefinitionsAzureUSGovernment = [for item in listPolicySetDefinitionsAzureUSGovernment: loadTextContent(item)] + +// The following var contains lists of files containing Policy Definition resources to load, grouped by compatibility with Cloud. +// To get a full list of Azure clouds, use the az cli command "az cloud list --output table" +// We use loadTextContent instead of loadJsonContent as this allows us to perform string replacement operations against the imported templates. +var loadPolicyDefinitions = { + All: [ + // Used in VM Policy Set Definition + loadTextContent('../../../services/Compute/virtualMachines/Deploy-VM-DataDiskReadLatency-Alert.json') + loadTextContent('../../../services/Compute/virtualMachines/Deploy-VM-DataDiskSpace-Alert.json') + loadTextContent('../../../services/Compute/virtualMachines/Deploy-VM-DataDiskWriteLatency-Alert.json') + loadTextContent('../../../services/Compute/virtualMachines/Deploy-VM-HeartBeat-Alert.json') + loadTextContent('../../../services/Compute/virtualMachines/Deploy-VM-NetworkIn-Alert.json') + loadTextContent('../../../services/Compute/virtualMachines/Deploy-VM-NetworkOut-Alert.json') + loadTextContent('../../../services/Compute/virtualMachines/Deploy-VM-OSDiskReadLatency-Alert.json') + loadTextContent('../../../services/Compute/virtualMachines/Deploy-VM-OSDiskSpace-Alert.json') + loadTextContent('../../../services/Compute/virtualMachines/Deploy-VM-OSDiskWriteLatency-Alert.json') + loadTextContent('../../../services/Compute/virtualMachines/Deploy-VM-PercentCPU-Alert.json') + loadTextContent('../../../services/Compute/virtualMachines/Deploy-VM-PercentMemory-Alert.json') + ] + AzureCloud: [] + AzureChinaCloud: [] + AzureUSGovernment: [] +} + +// The following var contains lists of files containing Policy Set Definition (Initiative) resources to load, grouped by compatibility with Cloud. +// To get a full list of Azure clouds, use the az cli command "az cloud list --output table" +// We use loadTextContent instead of loadJsonContent as this allows us to perform string replacement operations against the imported templates. +// Use string(loadJsonContent('../file.json')) when the JSON has more than 131072 characters +var loadPolicySetDefinitions = { + All: [ + string(loadJsonContent('../policySetDefinitions/Deploy-VM-Alerts.json')) + ] + AzureCloud: [] + AzureChinaCloud: [] + AzureUSGovernment: [] +} + +// The following vars are used to manipulate the imported Policy Definitions to replace deployment location values +// Needs a double replace to handle updates in both templates for All clouds, and localized templates +var processPolicyDefinitionsAll = [for content in loadPolicyDefinitions.All: replace(replace(content, templateVars.defaultDeploymentLocation, deploymentLocation), templateVars.localizedDeploymentLocation, deploymentLocation)] +var processPolicyDefinitionsAzureCloud = [for content in loadPolicyDefinitions.AzureCloud: replace(replace(content, templateVars.defaultDeploymentLocation, deploymentLocation), templateVars.localizedDeploymentLocation, deploymentLocation)] +var processPolicyDefinitionsAzureChinaCloud = [for content in loadPolicyDefinitions.AzureChinaCloud: replace(replace(content, templateVars.defaultDeploymentLocation, deploymentLocation), templateVars.localizedDeploymentLocation, deploymentLocation)] +var processPolicyDefinitionsAzureUSGovernment = [for content in loadPolicyDefinitions.AzureUSGovernment: replace(replace(content, templateVars.defaultDeploymentLocation, deploymentLocation), templateVars.localizedDeploymentLocation, deploymentLocation)] + +// The following vars are used to manipulate the imported Policy Set Definitions to replace Policy Definition scope values +var processPolicySetDefinitionsAll = [for content in loadPolicySetDefinitions.All: replace(content, templateVars.scope, scope)] +var processPolicySetDefinitionsAzureCloud = [for content in loadPolicySetDefinitions.AzureCloud: replace(content, templateVars.scope, scope)] +var processPolicySetDefinitionsAzureChinaCloud = [for content in loadPolicySetDefinitions.AzureChinaCloud: replace(content, templateVars.scope, scope)] +var processPolicySetDefinitionsAzureUSGovernment = [for content in loadPolicySetDefinitions.AzureUSGovernment: replace(content, templateVars.scope, scope)] + +// The following vars are used to convert the imported Policy Definitions into objects from JSON +var policyDefinitionsAll = [for content in processPolicyDefinitionsAll: json(content)] +var policyDefinitionsAzureCloud = [for content in processPolicyDefinitionsAzureCloud: json(content)] +var policyDefinitionsAzureChinaCloud = [for content in processPolicyDefinitionsAzureChinaCloud: json(content)] +var policyDefinitionsAzureUSGovernment = [for content in processPolicyDefinitionsAzureUSGovernment: json(content)] + +// The following vars are used to convert the imported Policy Set Definitions into objects from JSON +var policySetDefinitionsAll = [for content in processPolicySetDefinitionsAll: json(content)] +var policySetDefinitionsAzureCloud = [for content in processPolicySetDefinitionsAzureCloud: json(content)] +var policySetDefinitionsAzureChinaCloud = [for content in processPolicySetDefinitionsAzureChinaCloud: json(content)] +var policySetDefinitionsAzureUSGovernment = [for content in processPolicySetDefinitionsAzureUSGovernment: json(content)] + +// The following var is used to compile the required Policy Definitions into a single object +var policyDefinitionsByCloudType = { + All: policyDefinitionsAll + AzureCloud: policyDefinitionsAzureCloud + AzureChinaCloud: policyDefinitionsAzureChinaCloud + AzureUSGovernment: policyDefinitionsAzureUSGovernment +} + +// The following var is used to compile the required Policy Definitions into a single object +var policySetDefinitionsByCloudType = { + All: policySetDefinitionsAll + AzureCloud: policySetDefinitionsAzureCloud + AzureChinaCloud: policySetDefinitionsAzureChinaCloud + AzureUSGovernment: policySetDefinitionsAzureUSGovernment +} + +// The following var is used to extract the Policy Definitions into a single list for deployment +// This will contain all policy definitions classified as available for All cloud environments, and those for the current cloud environment +var policyDefinitions = concat(policyDefinitionsByCloudType.All, policyDefinitionsByCloudType[cloudEnv]) + +// The following var is used to extract the Policy Set Definitions into a single list for deployment +// This will contain all policy set definitions classified as available for All cloud environments, and those for the current cloud environment +var policySetDefinitions = concat(policySetDefinitionsByCloudType.All, policySetDefinitionsByCloudType[cloudEnv]) + +// Create the Policy Definitions as needed for the target cloud environment +resource PolicyDefinitions 'Microsoft.Authorization/policyDefinitions@2020-09-01' = [for policy in policyDefinitions: { + name: policy.name + properties: { + description: policy.properties.description + displayName: policy.properties.displayName + metadata: policy.properties.metadata + mode: policy.properties.mode + parameters: policy.properties.parameters + policyType: policy.properties.policyType + policyRule: policy.properties.policyRule + } +}] + +// Create the Policy Definitions as needed for the target cloud environment +// Depends on Policy Definitons to ensure they exist before creating dependent Policy Set Definitions (Initiatives) +resource PolicySetDefinitions 'Microsoft.Authorization/policySetDefinitions@2020-09-01' = [for policy in policySetDefinitions: { + dependsOn: [ + PolicyDefinitions + ] + name: policy.name + properties: { + description: policy.properties.description + displayName: policy.properties.displayName + metadata: policy.properties.metadata + parameters: policy.properties.parameters + policyType: policy.properties.policyType + policyDefinitions: policy.properties.policyDefinitions + policyDefinitionGroups: policy.properties.policyDefinitionGroups + } +}] + +output policyDefinitionNames array = [for policy in policyDefinitions: policy.name] +output policySetDefinitionNames array = [for policy in policySetDefinitions: policy.name] diff --git a/patterns/alz/templates/policies-Hybrid.bicep b/patterns/alz/templates/policies-Hybrid.bicep new file mode 100644 index 000000000..5e583823a --- /dev/null +++ b/patterns/alz/templates/policies-Hybrid.bicep @@ -0,0 +1,184 @@ +targetScope = 'managementGroup' + +@metadata({ message: 'The JSON version of this file is programatically generated from Bicep. PLEASE DO NOT UPDATE MANUALLY!!' }) +@description('Provide a prefix (unique at tenant-scope) for the Management Group hierarchy and other resources created as part of an Azure landing zone. DEFAULT VALUE = "alz"') +param topLevelManagementGroupPrefix string = 'alz' + +@description('Optionally set the deployment location for policies with Deploy If Not Exists effect. DEFAULT VALUE = "deployment().location"') +param location string = deployment().location + +@description('Optionally set the scope for custom Policy Definitions used in Policy Set Definitions (Initiatives). Must be one of \'/\', \'/subscriptions/id\' or \'/providers/Microsoft.Management/managementGroups/id\'. DEFAULT VALUE = \'/providers/Microsoft.Management/managementGroups/\${topLevelManagementGroupPrefix}\'') +param scope string = tenantResourceId('Microsoft.Management/managementGroups', topLevelManagementGroupPrefix) + +// Extract the environment name to dynamically determine which policies to deploy. +var cloudEnv = environment().name + +// Default deployment locations used in templates +var defaultDeploymentLocationByCloudType = { + AzureCloud: 'northeurope' + AzureChinaCloud: 'chinaeast2' + AzureUSGovernment: 'usgovvirginia' +} + +// Used to identify template variables used in the templates for replacement. +var templateVars = { + scope: '/providers/Microsoft.Management/managementGroups/contoso' + defaultDeploymentLocation: '"location": "northeurope"' + localizedDeploymentLocation: '"location": "${defaultDeploymentLocationByCloudType[cloudEnv]}"' +} + +var targetDeploymentLocationByCloudType = { + AzureCloud: location ?? 'northeurope' + AzureChinaCloud: location ?? 'chinaeast2' + AzureUSGovernment: location ?? 'usgovvirginia' +} + +var deploymentLocation = '"location": "${targetDeploymentLocationByCloudType[cloudEnv]}"' + +// Unable to do the following commented out approach due to the error "The value must be a compile-time constant.bicep(BCP032)" +// See: https://github.com/Azure/bicep/issues/3816#issuecomment-1191230215 + +// The following vars are used to load the list of Policy Definitions to import +// var listPolicyDefinitionsAll = loadJsonContent('../data/policyDefinitions.All.json') +// var listPolicyDefinitionsAzureCloud = loadJsonContent('../data/policyDefinitions.AzureCloud.json') +// var listPolicyDefinitionsAzureChinaCloud = loadJsonContent('../data/policyDefinitions.AzureChinaCloud.json') +// var listPolicyDefinitionsAzureUSGovernment = loadJsonContent('../data/policyDefinitions.AzureUSGovernment.json') + +// The following vars are used to load the list of Policy Set Definitions to import +// var listPolicySetDefinitionsAll = loadJsonContent('../data/policySetDefinitions.All.json') +// var listPolicySetDefinitionsAzureCloud = loadJsonContent('../data/policySetDefinitions.AzureCloud.json') +// var listPolicySetDefinitionsAzureChinaCloud = loadJsonContent('../data/policySetDefinitions.AzureChinaCloud.json') +// var listPolicySetDefinitionsAzureUSGovernment = loadJsonContent('../data/policySetDefinitions.AzureUSGovernment.json') + +// The following vars are used to load the list of Policy Definitions to import +// var loadPolicyDefinitionsAll = [for item in listPolicyDefinitionsAll: loadTextContent(item)] +// var loadPolicyDefinitionsAzureCloud = [for item in listPolicyDefinitionsAzureCloud: loadTextContent(item)] +// var loadPolicyDefinitionsAzureChinaCloud = [for item in listPolicyDefinitionsAzureChinaCloud: loadTextContent(item)] +// var loadPolicyDefinitionsAzureUSGovernment = [for item in listPolicyDefinitionsAzureUSGovernment: loadTextContent(item)] + +// The following vars are used to load the list of Policy Set Definitions to import +// var loadPolicySetDefinitionsAll = [for item in listPolicySetDefinitionsAll: loadTextContent(item)] +// var loadPolicySetDefinitionsAzureCloud = [for item in listPolicySetDefinitionsAzureCloud: loadTextContent(item)] +// var loadPolicySetDefinitionsAzureChinaCloud = [for item in listPolicySetDefinitionsAzureChinaCloud: loadTextContent(item)] +// var loadPolicySetDefinitionsAzureUSGovernment = [for item in listPolicySetDefinitionsAzureUSGovernment: loadTextContent(item)] + +// The following var contains lists of files containing Policy Definition resources to load, grouped by compatibility with Cloud. +// To get a full list of Azure clouds, use the az cli command "az cloud list --output table" +// We use loadTextContent instead of loadJsonContent as this allows us to perform string replacement operations against the imported templates. +var loadPolicyDefinitions = { + All: [ + // Used in HybridVM Policy Set Definition + loadTextContent('../../../services/HybridCompute/machines/Deploy-Hybrid-VM-DataDiskReadLatency-Alert.json') + loadTextContent('../../../services/HybridCompute/machines/Deploy-Hybrid-VM-DataDiskSpace-Alert.json') + loadTextContent('../../../services/HybridCompute/machines/Deploy-Hybrid-VM-DataDiskWriteLatency-Alert.json') + loadTextContent('../../../services/HybridCompute/machines/Deploy-Hybrid-VM-HeartBeat-Alert.json') + loadTextContent('../../../services/HybridCompute/machines/Deploy-Hybrid-VM-NetworkIn-Alert.json') + loadTextContent('../../../services/HybridCompute/machines/Deploy-Hybrid-VM-NetworkOut-Alert.json') + loadTextContent('../../../services/HybridCompute/machines/Deploy-Hybrid-VM-OSDiskReadLatency-Alert.json') + loadTextContent('../../../services/HybridCompute/machines/Deploy-Hybrid-VM-OSDiskSpace-Alert.json') + loadTextContent('../../../services/HybridCompute/machines/Deploy-Hybrid-VM-OSDiskWriteLatency-Alert.json') + loadTextContent('../../../services/HybridCompute/machines/Deploy-Hybrid-VM-PercentCPU-Alert.json') + loadTextContent('../../../services/HybridCompute/machines/Deploy-Hybrid-VM-PercentMemory-Alert.json') + loadTextContent('../../../services/HybridCompute/machines/Deploy-Hybrid-VM-Disconnected-Alert.json') + ] + AzureCloud: [] + AzureChinaCloud: [] + AzureUSGovernment: [] +} + +// The following var contains lists of files containing Policy Set Definition (Initiative) resources to load, grouped by compatibility with Cloud. +// To get a full list of Azure clouds, use the az cli command "az cloud list --output table" +// We use loadTextContent instead of loadJsonContent as this allows us to perform string replacement operations against the imported templates. +// Use string(loadJsonContent('../file.json')) when the JSON has more than 131072 characters +var loadPolicySetDefinitions = { + All: [ + string(loadJsonContent('../policySetDefinitions/Deploy-HybridVM-Alerts.json')) + ] + AzureCloud: [] + AzureChinaCloud: [] + AzureUSGovernment: [] +} + +// The following vars are used to manipulate the imported Policy Definitions to replace deployment location values +// Needs a double replace to handle updates in both templates for All clouds, and localized templates +var processPolicyDefinitionsAll = [for content in loadPolicyDefinitions.All: replace(replace(content, templateVars.defaultDeploymentLocation, deploymentLocation), templateVars.localizedDeploymentLocation, deploymentLocation)] +var processPolicyDefinitionsAzureCloud = [for content in loadPolicyDefinitions.AzureCloud: replace(replace(content, templateVars.defaultDeploymentLocation, deploymentLocation), templateVars.localizedDeploymentLocation, deploymentLocation)] +var processPolicyDefinitionsAzureChinaCloud = [for content in loadPolicyDefinitions.AzureChinaCloud: replace(replace(content, templateVars.defaultDeploymentLocation, deploymentLocation), templateVars.localizedDeploymentLocation, deploymentLocation)] +var processPolicyDefinitionsAzureUSGovernment = [for content in loadPolicyDefinitions.AzureUSGovernment: replace(replace(content, templateVars.defaultDeploymentLocation, deploymentLocation), templateVars.localizedDeploymentLocation, deploymentLocation)] + +// The following vars are used to manipulate the imported Policy Set Definitions to replace Policy Definition scope values +var processPolicySetDefinitionsAll = [for content in loadPolicySetDefinitions.All: replace(content, templateVars.scope, scope)] +var processPolicySetDefinitionsAzureCloud = [for content in loadPolicySetDefinitions.AzureCloud: replace(content, templateVars.scope, scope)] +var processPolicySetDefinitionsAzureChinaCloud = [for content in loadPolicySetDefinitions.AzureChinaCloud: replace(content, templateVars.scope, scope)] +var processPolicySetDefinitionsAzureUSGovernment = [for content in loadPolicySetDefinitions.AzureUSGovernment: replace(content, templateVars.scope, scope)] + +// The following vars are used to convert the imported Policy Definitions into objects from JSON +var policyDefinitionsAll = [for content in processPolicyDefinitionsAll: json(content)] +var policyDefinitionsAzureCloud = [for content in processPolicyDefinitionsAzureCloud: json(content)] +var policyDefinitionsAzureChinaCloud = [for content in processPolicyDefinitionsAzureChinaCloud: json(content)] +var policyDefinitionsAzureUSGovernment = [for content in processPolicyDefinitionsAzureUSGovernment: json(content)] + +// The following vars are used to convert the imported Policy Set Definitions into objects from JSON +var policySetDefinitionsAll = [for content in processPolicySetDefinitionsAll: json(content)] +var policySetDefinitionsAzureCloud = [for content in processPolicySetDefinitionsAzureCloud: json(content)] +var policySetDefinitionsAzureChinaCloud = [for content in processPolicySetDefinitionsAzureChinaCloud: json(content)] +var policySetDefinitionsAzureUSGovernment = [for content in processPolicySetDefinitionsAzureUSGovernment: json(content)] + +// The following var is used to compile the required Policy Definitions into a single object +var policyDefinitionsByCloudType = { + All: policyDefinitionsAll + AzureCloud: policyDefinitionsAzureCloud + AzureChinaCloud: policyDefinitionsAzureChinaCloud + AzureUSGovernment: policyDefinitionsAzureUSGovernment +} + +// The following var is used to compile the required Policy Definitions into a single object +var policySetDefinitionsByCloudType = { + All: policySetDefinitionsAll + AzureCloud: policySetDefinitionsAzureCloud + AzureChinaCloud: policySetDefinitionsAzureChinaCloud + AzureUSGovernment: policySetDefinitionsAzureUSGovernment +} + +// The following var is used to extract the Policy Definitions into a single list for deployment +// This will contain all policy definitions classified as available for All cloud environments, and those for the current cloud environment +var policyDefinitions = concat(policyDefinitionsByCloudType.All, policyDefinitionsByCloudType[cloudEnv]) + +// The following var is used to extract the Policy Set Definitions into a single list for deployment +// This will contain all policy set definitions classified as available for All cloud environments, and those for the current cloud environment +var policySetDefinitions = concat(policySetDefinitionsByCloudType.All, policySetDefinitionsByCloudType[cloudEnv]) + +// Create the Policy Definitions as needed for the target cloud environment +resource PolicyDefinitions 'Microsoft.Authorization/policyDefinitions@2020-09-01' = [for policy in policyDefinitions: { + name: policy.name + properties: { + description: policy.properties.description + displayName: policy.properties.displayName + metadata: policy.properties.metadata + mode: policy.properties.mode + parameters: policy.properties.parameters + policyType: policy.properties.policyType + policyRule: policy.properties.policyRule + } +}] + +// Create the Policy Definitions as needed for the target cloud environment +// Depends on Policy Definitons to ensure they exist before creating dependent Policy Set Definitions (Initiatives) +resource PolicySetDefinitions 'Microsoft.Authorization/policySetDefinitions@2020-09-01' = [for policy in policySetDefinitions: { + dependsOn: [ + PolicyDefinitions + ] + name: policy.name + properties: { + description: policy.properties.description + displayName: policy.properties.displayName + metadata: policy.properties.metadata + parameters: policy.properties.parameters + policyType: policy.properties.policyType + policyDefinitions: policy.properties.policyDefinitions + policyDefinitionGroups: policy.properties.policyDefinitionGroups + } +}] + +output policyDefinitionNames array = [for policy in policyDefinitions: policy.name] +output policySetDefinitionNames array = [for policy in policySetDefinitions: policy.name] diff --git a/patterns/alz/templates/policies-KeyManagement.bicep b/patterns/alz/templates/policies-KeyManagement.bicep new file mode 100644 index 000000000..2cf7b46e3 --- /dev/null +++ b/patterns/alz/templates/policies-KeyManagement.bicep @@ -0,0 +1,181 @@ +targetScope = 'managementGroup' + +@metadata({ message: 'The JSON version of this file is programatically generated from Bicep. PLEASE DO NOT UPDATE MANUALLY!!' }) +@description('Provide a prefix (unique at tenant-scope) for the Management Group hierarchy and other resources created as part of an Azure landing zone. DEFAULT VALUE = "alz"') +param topLevelManagementGroupPrefix string = 'alz' + +@description('Optionally set the deployment location for policies with Deploy If Not Exists effect. DEFAULT VALUE = "deployment().location"') +param location string = deployment().location + +@description('Optionally set the scope for custom Policy Definitions used in Policy Set Definitions (Initiatives). Must be one of \'/\', \'/subscriptions/id\' or \'/providers/Microsoft.Management/managementGroups/id\'. DEFAULT VALUE = \'/providers/Microsoft.Management/managementGroups/\${topLevelManagementGroupPrefix}\'') +param scope string = tenantResourceId('Microsoft.Management/managementGroups', topLevelManagementGroupPrefix) + +// Extract the environment name to dynamically determine which policies to deploy. +var cloudEnv = environment().name + +// Default deployment locations used in templates +var defaultDeploymentLocationByCloudType = { + AzureCloud: 'northeurope' + AzureChinaCloud: 'chinaeast2' + AzureUSGovernment: 'usgovvirginia' +} + +// Used to identify template variables used in the templates for replacement. +var templateVars = { + scope: '/providers/Microsoft.Management/managementGroups/contoso' + defaultDeploymentLocation: '"location": "northeurope"' + localizedDeploymentLocation: '"location": "${defaultDeploymentLocationByCloudType[cloudEnv]}"' +} + +var targetDeploymentLocationByCloudType = { + AzureCloud: location ?? 'northeurope' + AzureChinaCloud: location ?? 'chinaeast2' + AzureUSGovernment: location ?? 'usgovvirginia' +} + +var deploymentLocation = '"location": "${targetDeploymentLocationByCloudType[cloudEnv]}"' + +// Unable to do the following commented out approach due to the error "The value must be a compile-time constant.bicep(BCP032)" +// See: https://github.com/Azure/bicep/issues/3816#issuecomment-1191230215 + +// The following vars are used to load the list of Policy Definitions to import +// var listPolicyDefinitionsAll = loadJsonContent('../data/policyDefinitions.All.json') +// var listPolicyDefinitionsAzureCloud = loadJsonContent('../data/policyDefinitions.AzureCloud.json') +// var listPolicyDefinitionsAzureChinaCloud = loadJsonContent('../data/policyDefinitions.AzureChinaCloud.json') +// var listPolicyDefinitionsAzureUSGovernment = loadJsonContent('../data/policyDefinitions.AzureUSGovernment.json') + +// The following vars are used to load the list of Policy Set Definitions to import +// var listPolicySetDefinitionsAll = loadJsonContent('../data/policySetDefinitions.All.json') +// var listPolicySetDefinitionsAzureCloud = loadJsonContent('../data/policySetDefinitions.AzureCloud.json') +// var listPolicySetDefinitionsAzureChinaCloud = loadJsonContent('../data/policySetDefinitions.AzureChinaCloud.json') +// var listPolicySetDefinitionsAzureUSGovernment = loadJsonContent('../data/policySetDefinitions.AzureUSGovernment.json') + +// The following vars are used to load the list of Policy Definitions to import +// var loadPolicyDefinitionsAll = [for item in listPolicyDefinitionsAll: loadTextContent(item)] +// var loadPolicyDefinitionsAzureCloud = [for item in listPolicyDefinitionsAzureCloud: loadTextContent(item)] +// var loadPolicyDefinitionsAzureChinaCloud = [for item in listPolicyDefinitionsAzureChinaCloud: loadTextContent(item)] +// var loadPolicyDefinitionsAzureUSGovernment = [for item in listPolicyDefinitionsAzureUSGovernment: loadTextContent(item)] + +// The following vars are used to load the list of Policy Set Definitions to import +// var loadPolicySetDefinitionsAll = [for item in listPolicySetDefinitionsAll: loadTextContent(item)] +// var loadPolicySetDefinitionsAzureCloud = [for item in listPolicySetDefinitionsAzureCloud: loadTextContent(item)] +// var loadPolicySetDefinitionsAzureChinaCloud = [for item in listPolicySetDefinitionsAzureChinaCloud: loadTextContent(item)] +// var loadPolicySetDefinitionsAzureUSGovernment = [for item in listPolicySetDefinitionsAzureUSGovernment: loadTextContent(item)] + +// The following var contains lists of files containing Policy Definition resources to load, grouped by compatibility with Cloud. +// To get a full list of Azure clouds, use the az cli command "az cloud list --output table" +// We use loadTextContent instead of loadJsonContent as this allows us to perform string replacement operations against the imported templates. +var loadPolicyDefinitions = { + All: [ + // Used in both Identity and KeyManagement Policy Set Definitions + loadTextContent('../../../services/KeyVault/vaults/Deploy-KV-Availability-Alert.json') + loadTextContent('../../../services/KeyVault/vaults/Deploy-KV-Capacity-Alert.json') + loadTextContent('../../../services/KeyVault/vaults/Deploy-KV-Latency-Alert.json') + loadTextContent('../../../services/KeyVault/vaults/Deploy-KV-Requests-Alert.json') + loadTextContent('../../../services/KeyVault/vaults/Deploy-ActivityLog-KeyVault-Del.json') + loadTextContent('../../../services/KeyVault/managedHSMs/Deploy-ActivityLog-HSMs-Del.json') + loadTextContent('../../../services/KeyVault/managedHSMs/Deploy-HSMs-Availability-Alert.json') + loadTextContent('../../../services/KeyVault/managedHSMs/Deploy-HSMs-Latency-Alert.json') + ] + AzureCloud: [] + AzureChinaCloud: [] + AzureUSGovernment: [] +} + +// The following var contains lists of files containing Policy Set Definition (Initiative) resources to load, grouped by compatibility with Cloud. +// To get a full list of Azure clouds, use the az cli command "az cloud list --output table" +// We use loadTextContent instead of loadJsonContent as this allows us to perform string replacement operations against the imported templates. +// Use string(loadJsonContent('../file.json')) when the JSON has more than 131072 characters +var loadPolicySetDefinitions = { + All: [ + string(loadJsonContent('../policySetDefinitions/Deploy-KeyManagement-Alerts.json')) + string(loadJsonContent('../policySetDefinitions/Deploy-Identity-Alerts.json')) + ] + AzureCloud: [] + AzureChinaCloud: [] + AzureUSGovernment: [] +} + +// The following vars are used to manipulate the imported Policy Definitions to replace deployment location values +// Needs a double replace to handle updates in both templates for All clouds, and localized templates +var processPolicyDefinitionsAll = [for content in loadPolicyDefinitions.All: replace(replace(content, templateVars.defaultDeploymentLocation, deploymentLocation), templateVars.localizedDeploymentLocation, deploymentLocation)] +var processPolicyDefinitionsAzureCloud = [for content in loadPolicyDefinitions.AzureCloud: replace(replace(content, templateVars.defaultDeploymentLocation, deploymentLocation), templateVars.localizedDeploymentLocation, deploymentLocation)] +var processPolicyDefinitionsAzureChinaCloud = [for content in loadPolicyDefinitions.AzureChinaCloud: replace(replace(content, templateVars.defaultDeploymentLocation, deploymentLocation), templateVars.localizedDeploymentLocation, deploymentLocation)] +var processPolicyDefinitionsAzureUSGovernment = [for content in loadPolicyDefinitions.AzureUSGovernment: replace(replace(content, templateVars.defaultDeploymentLocation, deploymentLocation), templateVars.localizedDeploymentLocation, deploymentLocation)] + +// The following vars are used to manipulate the imported Policy Set Definitions to replace Policy Definition scope values +var processPolicySetDefinitionsAll = [for content in loadPolicySetDefinitions.All: replace(content, templateVars.scope, scope)] +var processPolicySetDefinitionsAzureCloud = [for content in loadPolicySetDefinitions.AzureCloud: replace(content, templateVars.scope, scope)] +var processPolicySetDefinitionsAzureChinaCloud = [for content in loadPolicySetDefinitions.AzureChinaCloud: replace(content, templateVars.scope, scope)] +var processPolicySetDefinitionsAzureUSGovernment = [for content in loadPolicySetDefinitions.AzureUSGovernment: replace(content, templateVars.scope, scope)] + +// The following vars are used to convert the imported Policy Definitions into objects from JSON +var policyDefinitionsAll = [for content in processPolicyDefinitionsAll: json(content)] +var policyDefinitionsAzureCloud = [for content in processPolicyDefinitionsAzureCloud: json(content)] +var policyDefinitionsAzureChinaCloud = [for content in processPolicyDefinitionsAzureChinaCloud: json(content)] +var policyDefinitionsAzureUSGovernment = [for content in processPolicyDefinitionsAzureUSGovernment: json(content)] + +// The following vars are used to convert the imported Policy Set Definitions into objects from JSON +var policySetDefinitionsAll = [for content in processPolicySetDefinitionsAll: json(content)] +var policySetDefinitionsAzureCloud = [for content in processPolicySetDefinitionsAzureCloud: json(content)] +var policySetDefinitionsAzureChinaCloud = [for content in processPolicySetDefinitionsAzureChinaCloud: json(content)] +var policySetDefinitionsAzureUSGovernment = [for content in processPolicySetDefinitionsAzureUSGovernment: json(content)] + +// The following var is used to compile the required Policy Definitions into a single object +var policyDefinitionsByCloudType = { + All: policyDefinitionsAll + AzureCloud: policyDefinitionsAzureCloud + AzureChinaCloud: policyDefinitionsAzureChinaCloud + AzureUSGovernment: policyDefinitionsAzureUSGovernment +} + +// The following var is used to compile the required Policy Definitions into a single object +var policySetDefinitionsByCloudType = { + All: policySetDefinitionsAll + AzureCloud: policySetDefinitionsAzureCloud + AzureChinaCloud: policySetDefinitionsAzureChinaCloud + AzureUSGovernment: policySetDefinitionsAzureUSGovernment +} + +// The following var is used to extract the Policy Definitions into a single list for deployment +// This will contain all policy definitions classified as available for All cloud environments, and those for the current cloud environment +var policyDefinitions = concat(policyDefinitionsByCloudType.All, policyDefinitionsByCloudType[cloudEnv]) + +// The following var is used to extract the Policy Set Definitions into a single list for deployment +// This will contain all policy set definitions classified as available for All cloud environments, and those for the current cloud environment +var policySetDefinitions = concat(policySetDefinitionsByCloudType.All, policySetDefinitionsByCloudType[cloudEnv]) + +// Create the Policy Definitions as needed for the target cloud environment +resource PolicyDefinitions 'Microsoft.Authorization/policyDefinitions@2020-09-01' = [for policy in policyDefinitions: { + name: policy.name + properties: { + description: policy.properties.description + displayName: policy.properties.displayName + metadata: policy.properties.metadata + mode: policy.properties.mode + parameters: policy.properties.parameters + policyType: policy.properties.policyType + policyRule: policy.properties.policyRule + } +}] + +// Create the Policy Definitions as needed for the target cloud environment +// Depends on Policy Definitons to ensure they exist before creating dependent Policy Set Definitions (Initiatives) +resource PolicySetDefinitions 'Microsoft.Authorization/policySetDefinitions@2020-09-01' = [for policy in policySetDefinitions: { + dependsOn: [ + PolicyDefinitions + ] + name: policy.name + properties: { + description: policy.properties.description + displayName: policy.properties.displayName + metadata: policy.properties.metadata + parameters: policy.properties.parameters + policyType: policy.properties.policyType + policyDefinitions: policy.properties.policyDefinitions + policyDefinitionGroups: policy.properties.policyDefinitionGroups + } +}] + +output policyDefinitionNames array = [for policy in policyDefinitions: policy.name] +output policySetDefinitionNames array = [for policy in policySetDefinitions: policy.name] diff --git a/patterns/alz/templates/policies-Monitoring.bicep b/patterns/alz/templates/policies-Monitoring.bicep new file mode 100644 index 000000000..77a2bdf3d --- /dev/null +++ b/patterns/alz/templates/policies-Monitoring.bicep @@ -0,0 +1,173 @@ +targetScope = 'managementGroup' + +@metadata({ message: 'The JSON version of this file is programatically generated from Bicep. PLEASE DO NOT UPDATE MANUALLY!!' }) +@description('Provide a prefix (unique at tenant-scope) for the Management Group hierarchy and other resources created as part of an Azure landing zone. DEFAULT VALUE = "alz"') +param topLevelManagementGroupPrefix string = 'alz' + +@description('Optionally set the deployment location for policies with Deploy If Not Exists effect. DEFAULT VALUE = "deployment().location"') +param location string = deployment().location + +@description('Optionally set the scope for custom Policy Definitions used in Policy Set Definitions (Initiatives). Must be one of \'/\', \'/subscriptions/id\' or \'/providers/Microsoft.Management/managementGroups/id\'. DEFAULT VALUE = \'/providers/Microsoft.Management/managementGroups/\${topLevelManagementGroupPrefix}\'') +param scope string = tenantResourceId('Microsoft.Management/managementGroups', topLevelManagementGroupPrefix) + +// Extract the environment name to dynamically determine which policies to deploy. +var cloudEnv = environment().name + +// Default deployment locations used in templates +var defaultDeploymentLocationByCloudType = { + AzureCloud: 'northeurope' + AzureChinaCloud: 'chinaeast2' + AzureUSGovernment: 'usgovvirginia' +} + +// Used to identify template variables used in the templates for replacement. +var templateVars = { + scope: '/providers/Microsoft.Management/managementGroups/contoso' + defaultDeploymentLocation: '"location": "northeurope"' + localizedDeploymentLocation: '"location": "${defaultDeploymentLocationByCloudType[cloudEnv]}"' +} + +var targetDeploymentLocationByCloudType = { + AzureCloud: location ?? 'northeurope' + AzureChinaCloud: location ?? 'chinaeast2' + AzureUSGovernment: location ?? 'usgovvirginia' +} + +var deploymentLocation = '"location": "${targetDeploymentLocationByCloudType[cloudEnv]}"' + +// Unable to do the following commented out approach due to the error "The value must be a compile-time constant.bicep(BCP032)" +// See: https://github.com/Azure/bicep/issues/3816#issuecomment-1191230215 + +// The following vars are used to load the list of Policy Definitions to import +// var listPolicyDefinitionsAll = loadJsonContent('../data/policyDefinitions.All.json') +// var listPolicyDefinitionsAzureCloud = loadJsonContent('../data/policyDefinitions.AzureCloud.json') +// var listPolicyDefinitionsAzureChinaCloud = loadJsonContent('../data/policyDefinitions.AzureChinaCloud.json') +// var listPolicyDefinitionsAzureUSGovernment = loadJsonContent('../data/policyDefinitions.AzureUSGovernment.json') + +// The following vars are used to load the list of Policy Set Definitions to import +// var listPolicySetDefinitionsAll = loadJsonContent('../data/policySetDefinitions.All.json') +// var listPolicySetDefinitionsAzureCloud = loadJsonContent('../data/policySetDefinitions.AzureCloud.json') +// var listPolicySetDefinitionsAzureChinaCloud = loadJsonContent('../data/policySetDefinitions.AzureChinaCloud.json') +// var listPolicySetDefinitionsAzureUSGovernment = loadJsonContent('../data/policySetDefinitions.AzureUSGovernment.json') + +// The following vars are used to load the list of Policy Definitions to import +// var loadPolicyDefinitionsAll = [for item in listPolicyDefinitionsAll: loadTextContent(item)] +// var loadPolicyDefinitionsAzureCloud = [for item in listPolicyDefinitionsAzureCloud: loadTextContent(item)] +// var loadPolicyDefinitionsAzureChinaCloud = [for item in listPolicyDefinitionsAzureChinaCloud: loadTextContent(item)] +// var loadPolicyDefinitionsAzureUSGovernment = [for item in listPolicyDefinitionsAzureUSGovernment: loadTextContent(item)] + +// The following vars are used to load the list of Policy Set Definitions to import +// var loadPolicySetDefinitionsAll = [for item in listPolicySetDefinitionsAll: loadTextContent(item)] +// var loadPolicySetDefinitionsAzureCloud = [for item in listPolicySetDefinitionsAzureCloud: loadTextContent(item)] +// var loadPolicySetDefinitionsAzureChinaCloud = [for item in listPolicySetDefinitionsAzureChinaCloud: loadTextContent(item)] +// var loadPolicySetDefinitionsAzureUSGovernment = [for item in listPolicySetDefinitionsAzureUSGovernment: loadTextContent(item)] + +// The following var contains lists of files containing Policy Definition resources to load, grouped by compatibility with Cloud. +// To get a full list of Azure clouds, use the az cli command "az cloud list --output table" +// We use loadTextContent instead of loadJsonContent as this allows us to perform string replacement operations against the imported templates. +var loadPolicyDefinitions = { + All: [ + // Used in Management Policy Set Definition + loadTextContent('../../../services/OperationalInsights/workspaces/Deploy-ActivityLog-LAWorkspace-Del.json') + loadTextContent('../../../services/OperationalInsights/workspaces/Deploy-ActivityLog-LAWorkspace-KeyRegen.json') + loadTextContent('../../../services/OperationalInsights/workspaces/Deploy-LAWorkspace-DailyCapLimitReached-Alert.json') + ] + AzureCloud: [] + AzureChinaCloud: [] + AzureUSGovernment: [] +} + +// The following var contains lists of files containing Policy Set Definition (Initiative) resources to load, grouped by compatibility with Cloud. +// To get a full list of Azure clouds, use the az cli command "az cloud list --output table" +// We use loadTextContent instead of loadJsonContent as this allows us to perform string replacement operations against the imported templates. +// Use string(loadJsonContent('../file.json')) when the JSON has more than 131072 characters +var loadPolicySetDefinitions = { + All: [] + AzureCloud: [] + AzureChinaCloud: [] + AzureUSGovernment: [] +} + +// The following vars are used to manipulate the imported Policy Definitions to replace deployment location values +// Needs a double replace to handle updates in both templates for All clouds, and localized templates +var processPolicyDefinitionsAll = [for content in loadPolicyDefinitions.All: replace(replace(content, templateVars.defaultDeploymentLocation, deploymentLocation), templateVars.localizedDeploymentLocation, deploymentLocation)] +var processPolicyDefinitionsAzureCloud = [for content in loadPolicyDefinitions.AzureCloud: replace(replace(content, templateVars.defaultDeploymentLocation, deploymentLocation), templateVars.localizedDeploymentLocation, deploymentLocation)] +var processPolicyDefinitionsAzureChinaCloud = [for content in loadPolicyDefinitions.AzureChinaCloud: replace(replace(content, templateVars.defaultDeploymentLocation, deploymentLocation), templateVars.localizedDeploymentLocation, deploymentLocation)] +var processPolicyDefinitionsAzureUSGovernment = [for content in loadPolicyDefinitions.AzureUSGovernment: replace(replace(content, templateVars.defaultDeploymentLocation, deploymentLocation), templateVars.localizedDeploymentLocation, deploymentLocation)] + +// The following vars are used to manipulate the imported Policy Set Definitions to replace Policy Definition scope values +var processPolicySetDefinitionsAll = [for content in loadPolicySetDefinitions.All: replace(content, templateVars.scope, scope)] +var processPolicySetDefinitionsAzureCloud = [for content in loadPolicySetDefinitions.AzureCloud: replace(content, templateVars.scope, scope)] +var processPolicySetDefinitionsAzureChinaCloud = [for content in loadPolicySetDefinitions.AzureChinaCloud: replace(content, templateVars.scope, scope)] +var processPolicySetDefinitionsAzureUSGovernment = [for content in loadPolicySetDefinitions.AzureUSGovernment: replace(content, templateVars.scope, scope)] + +// The following vars are used to convert the imported Policy Definitions into objects from JSON +var policyDefinitionsAll = [for content in processPolicyDefinitionsAll: json(content)] +var policyDefinitionsAzureCloud = [for content in processPolicyDefinitionsAzureCloud: json(content)] +var policyDefinitionsAzureChinaCloud = [for content in processPolicyDefinitionsAzureChinaCloud: json(content)] +var policyDefinitionsAzureUSGovernment = [for content in processPolicyDefinitionsAzureUSGovernment: json(content)] + +// The following vars are used to convert the imported Policy Set Definitions into objects from JSON +var policySetDefinitionsAll = [for content in processPolicySetDefinitionsAll: json(content)] +var policySetDefinitionsAzureCloud = [for content in processPolicySetDefinitionsAzureCloud: json(content)] +var policySetDefinitionsAzureChinaCloud = [for content in processPolicySetDefinitionsAzureChinaCloud: json(content)] +var policySetDefinitionsAzureUSGovernment = [for content in processPolicySetDefinitionsAzureUSGovernment: json(content)] + +// The following var is used to compile the required Policy Definitions into a single object +var policyDefinitionsByCloudType = { + All: policyDefinitionsAll + AzureCloud: policyDefinitionsAzureCloud + AzureChinaCloud: policyDefinitionsAzureChinaCloud + AzureUSGovernment: policyDefinitionsAzureUSGovernment +} + +// The following var is used to compile the required Policy Definitions into a single object +var policySetDefinitionsByCloudType = { + All: policySetDefinitionsAll + AzureCloud: policySetDefinitionsAzureCloud + AzureChinaCloud: policySetDefinitionsAzureChinaCloud + AzureUSGovernment: policySetDefinitionsAzureUSGovernment +} + +// The following var is used to extract the Policy Definitions into a single list for deployment +// This will contain all policy definitions classified as available for All cloud environments, and those for the current cloud environment +var policyDefinitions = concat(policyDefinitionsByCloudType.All, policyDefinitionsByCloudType[cloudEnv]) + +// The following var is used to extract the Policy Set Definitions into a single list for deployment +// This will contain all policy set definitions classified as available for All cloud environments, and those for the current cloud environment +var policySetDefinitions = concat(policySetDefinitionsByCloudType.All, policySetDefinitionsByCloudType[cloudEnv]) + +// Create the Policy Definitions as needed for the target cloud environment +resource PolicyDefinitions 'Microsoft.Authorization/policyDefinitions@2020-09-01' = [for policy in policyDefinitions: { + name: policy.name + properties: { + description: policy.properties.description + displayName: policy.properties.displayName + metadata: policy.properties.metadata + mode: policy.properties.mode + parameters: policy.properties.parameters + policyType: policy.properties.policyType + policyRule: policy.properties.policyRule + } +}] + +// Create the Policy Definitions as needed for the target cloud environment +// Depends on Policy Definitons to ensure they exist before creating dependent Policy Set Definitions (Initiatives) +resource PolicySetDefinitions 'Microsoft.Authorization/policySetDefinitions@2020-09-01' = [for policy in policySetDefinitions: { + dependsOn: [ + PolicyDefinitions + ] + name: policy.name + properties: { + description: policy.properties.description + displayName: policy.properties.displayName + metadata: policy.properties.metadata + parameters: policy.properties.parameters + policyType: policy.properties.policyType + policyDefinitions: policy.properties.policyDefinitions + policyDefinitionGroups: policy.properties.policyDefinitionGroups + } +}] + +output policyDefinitionNames array = [for policy in policyDefinitions: policy.name] +output policySetDefinitionNames array = [for policy in policySetDefinitions: policy.name] diff --git a/patterns/alz/templates/policies-Network.bicep b/patterns/alz/templates/policies-Network.bicep new file mode 100644 index 000000000..ff60491fe --- /dev/null +++ b/patterns/alz/templates/policies-Network.bicep @@ -0,0 +1,242 @@ +targetScope = 'managementGroup' + +@metadata({ message: 'The JSON version of this file is programatically generated from Bicep. PLEASE DO NOT UPDATE MANUALLY!!' }) +@description('Provide a prefix (unique at tenant-scope) for the Management Group hierarchy and other resources created as part of an Azure landing zone. DEFAULT VALUE = "alz"') +param topLevelManagementGroupPrefix string = 'alz' + +@description('Optionally set the deployment location for policies with Deploy If Not Exists effect. DEFAULT VALUE = "deployment().location"') +param location string = deployment().location + +@description('Optionally set the scope for custom Policy Definitions used in Policy Set Definitions (Initiatives). Must be one of \'/\', \'/subscriptions/id\' or \'/providers/Microsoft.Management/managementGroups/id\'. DEFAULT VALUE = \'/providers/Microsoft.Management/managementGroups/\${topLevelManagementGroupPrefix}\'') +param scope string = tenantResourceId('Microsoft.Management/managementGroups', topLevelManagementGroupPrefix) + +// Extract the environment name to dynamically determine which policies to deploy. +var cloudEnv = environment().name + +// Default deployment locations used in templates +var defaultDeploymentLocationByCloudType = { + AzureCloud: 'northeurope' + AzureChinaCloud: 'chinaeast2' + AzureUSGovernment: 'usgovvirginia' +} + +// Used to identify template variables used in the templates for replacement. +var templateVars = { + scope: '/providers/Microsoft.Management/managementGroups/contoso' + defaultDeploymentLocation: '"location": "northeurope"' + localizedDeploymentLocation: '"location": "${defaultDeploymentLocationByCloudType[cloudEnv]}"' +} + +var targetDeploymentLocationByCloudType = { + AzureCloud: location ?? 'northeurope' + AzureChinaCloud: location ?? 'chinaeast2' + AzureUSGovernment: location ?? 'usgovvirginia' +} + +var deploymentLocation = '"location": "${targetDeploymentLocationByCloudType[cloudEnv]}"' + +// Unable to do the following commented out approach due to the error "The value must be a compile-time constant.bicep(BCP032)" +// See: https://github.com/Azure/bicep/issues/3816#issuecomment-1191230215 + +// The following vars are used to load the list of Policy Definitions to import +// var listPolicyDefinitionsAll = loadJsonContent('../data/policyDefinitions.All.json') +// var listPolicyDefinitionsAzureCloud = loadJsonContent('../data/policyDefinitions.AzureCloud.json') +// var listPolicyDefinitionsAzureChinaCloud = loadJsonContent('../data/policyDefinitions.AzureChinaCloud.json') +// var listPolicyDefinitionsAzureUSGovernment = loadJsonContent('../data/policyDefinitions.AzureUSGovernment.json') + +// The following vars are used to load the list of Policy Set Definitions to import +// var listPolicySetDefinitionsAll = loadJsonContent('../data/policySetDefinitions.All.json') +// var listPolicySetDefinitionsAzureCloud = loadJsonContent('../data/policySetDefinitions.AzureCloud.json') +// var listPolicySetDefinitionsAzureChinaCloud = loadJsonContent('../data/policySetDefinitions.AzureChinaCloud.json') +// var listPolicySetDefinitionsAzureUSGovernment = loadJsonContent('../data/policySetDefinitions.AzureUSGovernment.json') + +// The following vars are used to load the list of Policy Definitions to import +// var loadPolicyDefinitionsAll = [for item in listPolicyDefinitionsAll: loadTextContent(item)] +// var loadPolicyDefinitionsAzureCloud = [for item in listPolicyDefinitionsAzureCloud: loadTextContent(item)] +// var loadPolicyDefinitionsAzureChinaCloud = [for item in listPolicyDefinitionsAzureChinaCloud: loadTextContent(item)] +// var loadPolicyDefinitionsAzureUSGovernment = [for item in listPolicyDefinitionsAzureUSGovernment: loadTextContent(item)] + +// The following vars are used to load the list of Policy Set Definitions to import +// var loadPolicySetDefinitionsAll = [for item in listPolicySetDefinitionsAll: loadTextContent(item)] +// var loadPolicySetDefinitionsAzureCloud = [for item in listPolicySetDefinitionsAzureCloud: loadTextContent(item)] +// var loadPolicySetDefinitionsAzureChinaCloud = [for item in listPolicySetDefinitionsAzureChinaCloud: loadTextContent(item)] +// var loadPolicySetDefinitionsAzureUSGovernment = [for item in listPolicySetDefinitionsAzureUSGovernment: loadTextContent(item)] + +// The following var contains lists of files containing Policy Definition resources to load, grouped by compatibility with Cloud. +// To get a full list of Azure clouds, use the az cli command "az cloud list --output table" +// We use loadTextContent instead of loadJsonContent as this allows us to perform string replacement operations against the imported templates. +var loadPolicyDefinitions = { + All: [ + // Used in Connectivity Policy Set Definition + loadTextContent('../../../services/Network/azureFirewalls/Deploy-ActivityLog-AzureFirewall-Del.json') + loadTextContent('../../../services/Network/azureFirewalls/Deploy-AFW-FirewallHealth-Alert.json') + loadTextContent('../../../services/Network/azureFirewalls/Deploy-AFW-SNATPortUtilization-Alert.json') + loadTextContent('../../../services/Network/expressRouteCircuits/Deploy-ERCIR-ARPAvailability-Alert.json') + loadTextContent('../../../services/Network/expressRouteCircuits/Deploy-ERCIR-BGPAvailability-Alert.json') + loadTextContent('../../../services/Network/expressRouteCircuits/Deploy-ERCIR-QOSDropsBitsIn-Alert.json') + loadTextContent('../../../services/Network/expressRouteCircuits/Deploy-ERCIR-QOSDropsBitsOut-Alert.json') + loadTextContent('../../../services/Network/expressRouteGateways/Deploy-ERG-BitsInPerSecond-Alert.json') + loadTextContent('../../../services/Network/expressRouteGateways/Deploy-ERG-BitsOutPerSecond-Alert.json') + loadTextContent('../../../services/Network/expressRouteGateways/Deploy-ERG-CPUUtilization-Alert.json') + loadTextContent('../../../services/Network/expressRoutePorts/Deploy-ERP-BitsInPerSecond-Alert.json') + loadTextContent('../../../services/Network/expressRoutePorts/Deploy-ERP-BitsOutPerSecond-Alert.json') + loadTextContent('../../../services/Network/expressRoutePorts/Deploy-ERP-LineProtocol-Alert.json') + loadTextContent('../../../services/Network/expressRoutePorts/Deploy-ERP-RxLightLevelHigh-Alert.json') + loadTextContent('../../../services/Network/expressRoutePorts/Deploy-ERP-RxLightLevelLow-Alert.json') + loadTextContent('../../../services/Network/expressRoutePorts/Deploy-ERP-TxLightLevelHigh-Alert.json') + loadTextContent('../../../services/Network/expressRoutePorts/Deploy-ERP-TxLightLevelLow-Alert.json') + loadTextContent('../../../services/Network/privateDnsZones/Deploy-PDNSZ-CapacityUtilization-Alert.json') + loadTextContent('../../../services/Network/privateDnsZones/Deploy-PDNSZ-QueryVolume-Alert.json') + loadTextContent('../../../services/Network/privateDnsZones/Deploy-PDNSZ-RecordSetCapacity-Alert.json') + loadTextContent('../../../services/Network/privateDnsZones/Deploy-PDNSZ-RegistrationCapacityUtilization-Alert.json') + loadTextContent('../../../services/Network/virtualNetworkGateways/Deploy-VNETG-ERGBitsPerSecond-Alert.json') + loadTextContent('../../../services/Network/virtualNetworkGateways/Deploy-VNETG-ERGCPUUtilization-Alert.json') + loadTextContent('../../../services/Network/virtualNetworkGateways/Deploy-VNETG-BandwidthUtilization-Alert.json') + loadTextContent('../../../services/Network/virtualNetworkGateways/Deploy-VNETG-Egress-Alert.json') + loadTextContent('../../../services/Network/virtualNetworkGateways/Deploy-VNETG-EgressPacketDropCount-Alert.json') + loadTextContent('../../../services/Network/virtualNetworkGateways/Deploy-VNETG-EgressPacketDropMismatch-Alert.json') + loadTextContent('../../../services/Network/virtualNetworkGateways/Deploy-VNETG-Ingress-Alert.json') + loadTextContent('../../../services/Network/virtualNetworkGateways/Deploy-VNETG-IngressPacketDropCount-Alert.json') + loadTextContent('../../../services/Network/virtualNetworkGateways/Deploy-VNETG-IngressPacketDropMismatch-Alert.json') + loadTextContent('../../../services/Network/vpnGateways/Deploy-ActivityLog-VPNG-Del.json') + loadTextContent('../../../services/Network/vpnGateways/Deploy-VPNG-BandwidthUtilization-Alert.json') + loadTextContent('../../../services/Network/vpnGateways/Deploy-VPNG-BGPPeerStatus-Alert.json') + loadTextContent('../../../services/Network/vpnGateways/Deploy-VPNG-Egress-Alert.json') + loadTextContent('../../../services/Network/vpnGateways/Deploy-VPNG-EgressPacketDropCount-Alert.json') + loadTextContent('../../../services/Network/vpnGateways/Deploy-VPNG-EgressPacketDropMismatch-Alert.json') + loadTextContent('../../../services/Network/vpnGateways/Deploy-VPNG-Ingress-Alert.json') + loadTextContent('../../../services/Network/vpnGateways/Deploy-VPNG-IngressPacketDropCount-Alert.json') + loadTextContent('../../../services/Network/vpnGateways/Deploy-VPNG-IngressPacketDropMismatch-Alert.json') + // Used in LoadBalancing Policy Set Definition + loadTextContent('../../../services/Network/applicationGateways/Deploy-AGW-ApplicationGatewayTotalTime-Alert.json') + loadTextContent('../../../services/Network/applicationGateways/Deploy-AGW-BackendLastByteResponseTime-Alert.json') + loadTextContent('../../../services/Network/applicationGateways/Deploy-AGW-CapacityUnits-Alert.json') + loadTextContent('../../../services/Network/applicationGateways/Deploy-AGW-ComputeUnits-Alert.json') + loadTextContent('../../../services/Network/applicationGateways/Deploy-AGW-CPUUtil-Alert.json') + loadTextContent('../../../services/Network/applicationGateways/Deploy-AGW-FailedRequests-Alert.json') + loadTextContent('../../../services/Network/applicationGateways/Deploy-AGW-ResponseStatus-Alert.json') + loadTextContent('../../../services/Network/applicationGateways/Deploy-AGW-UnhealthyHostCount-Alert.json') + loadTextContent('../../../services/Network/trafficmanagerprofiles/Deploy-TM-EndpointHealth-Alert.json') + loadTextContent('../../../services/Network/frontDoors/Deploy-FD-BackendHealth-Alert.json') + loadTextContent('../../../services/Network/frontDoors/Deploy-FD-BackendRequestLatency-Alert.json') + loadTextContent('../../../services/Cdn/profiles/Deploy-CDNP-OriginHealthPercentage-Alert.json') + loadTextContent('../../../services/Cdn/profiles/Deploy-CDNP-OriginLatency-Alert.json') + loadTextContent('../../../services/Cdn/profiles/Deploy-CDNP-Percentage4XX-Alert.json') + loadTextContent('../../../services/Cdn/profiles/Deploy-CDNP-Percentage5XX-Alert.json') + // Used in both Connectivity and LoadBalancing Policy Set Definitions + loadTextContent('../../../services/Network/loadBalancers/Deploy-LB-DatapathAvailability-Alert.json') + loadTextContent('../../../services/Network/loadBalancers/Deploy-LB-GlobalBackendAvailability-Alert.json') + loadTextContent('../../../services/Network/loadBalancers/Deploy-LB-HealthProbeStatus-Alert.json') + loadTextContent('../../../services/Network/loadBalancers/Deploy-LB-UsedSNATPorts-Alert.json') + loadTextContent('../../../services/Network/publicIPAddresses/Deploy-PIP-BytesInDDOSAttack-Alert.json') + loadTextContent('../../../services/Network/publicIPAddresses/Deploy-PIP-DDOSAttack-Alert.json') + loadTextContent('../../../services/Network/publicIPAddresses/Deploy-PIP-PacketsInDDOS-Alert.json') + loadTextContent('../../../services/Network/publicIPAddresses/Deploy-PIP-VIPAvailability-Alert.json') + loadTextContent('../../../services/Network/virtualNetworks/Deploy-VNET-DDOSAttack-Alert.json') + // Used in both Connectivity and NetworkChanges Policy Set Definitions + loadTextContent('../../../services/Network/routeTables/Deploy-ActivityLog-RouteTable-Update.json') + loadTextContent('../../../services/Network/networkSecurityGroups/Deploy-ActivityLog-NSG-Del.json') + ] + AzureCloud: [] + AzureChinaCloud: [] + AzureUSGovernment: [] +} + +// The following var contains lists of files containing Policy Set Definition (Initiative) resources to load, grouped by compatibility with Cloud. +// To get a full list of Azure clouds, use the az cli command "az cloud list --output table" +// We use loadTextContent instead of loadJsonContent as this allows us to perform string replacement operations against the imported templates. +// Use string(loadJsonContent('../file.json')) when the JSON has more than 131072 characters +var loadPolicySetDefinitions = { + All: [ + string(loadJsonContent('../policySetDefinitions/Deploy-Connectivity-Alerts.json')) + string(loadJsonContent('../policySetDefinitions/Deploy-LoadBalancing-Alerts.json')) + string(loadJsonContent('../policySetDefinitions/Deploy-NetworkChanges-Alerts.json')) + ] + AzureCloud: [] + AzureChinaCloud: [] + AzureUSGovernment: [] +} + +// The following vars are used to manipulate the imported Policy Definitions to replace deployment location values +// Needs a double replace to handle updates in both templates for All clouds, and localized templates +var processPolicyDefinitionsAll = [for content in loadPolicyDefinitions.All: replace(replace(content, templateVars.defaultDeploymentLocation, deploymentLocation), templateVars.localizedDeploymentLocation, deploymentLocation)] +var processPolicyDefinitionsAzureCloud = [for content in loadPolicyDefinitions.AzureCloud: replace(replace(content, templateVars.defaultDeploymentLocation, deploymentLocation), templateVars.localizedDeploymentLocation, deploymentLocation)] +var processPolicyDefinitionsAzureChinaCloud = [for content in loadPolicyDefinitions.AzureChinaCloud: replace(replace(content, templateVars.defaultDeploymentLocation, deploymentLocation), templateVars.localizedDeploymentLocation, deploymentLocation)] +var processPolicyDefinitionsAzureUSGovernment = [for content in loadPolicyDefinitions.AzureUSGovernment: replace(replace(content, templateVars.defaultDeploymentLocation, deploymentLocation), templateVars.localizedDeploymentLocation, deploymentLocation)] + +// The following vars are used to manipulate the imported Policy Set Definitions to replace Policy Definition scope values +var processPolicySetDefinitionsAll = [for content in loadPolicySetDefinitions.All: replace(content, templateVars.scope, scope)] +var processPolicySetDefinitionsAzureCloud = [for content in loadPolicySetDefinitions.AzureCloud: replace(content, templateVars.scope, scope)] +var processPolicySetDefinitionsAzureChinaCloud = [for content in loadPolicySetDefinitions.AzureChinaCloud: replace(content, templateVars.scope, scope)] +var processPolicySetDefinitionsAzureUSGovernment = [for content in loadPolicySetDefinitions.AzureUSGovernment: replace(content, templateVars.scope, scope)] + +// The following vars are used to convert the imported Policy Definitions into objects from JSON +var policyDefinitionsAll = [for content in processPolicyDefinitionsAll: json(content)] +var policyDefinitionsAzureCloud = [for content in processPolicyDefinitionsAzureCloud: json(content)] +var policyDefinitionsAzureChinaCloud = [for content in processPolicyDefinitionsAzureChinaCloud: json(content)] +var policyDefinitionsAzureUSGovernment = [for content in processPolicyDefinitionsAzureUSGovernment: json(content)] + +// The following vars are used to convert the imported Policy Set Definitions into objects from JSON +var policySetDefinitionsAll = [for content in processPolicySetDefinitionsAll: json(content)] +var policySetDefinitionsAzureCloud = [for content in processPolicySetDefinitionsAzureCloud: json(content)] +var policySetDefinitionsAzureChinaCloud = [for content in processPolicySetDefinitionsAzureChinaCloud: json(content)] +var policySetDefinitionsAzureUSGovernment = [for content in processPolicySetDefinitionsAzureUSGovernment: json(content)] + +// The following var is used to compile the required Policy Definitions into a single object +var policyDefinitionsByCloudType = { + All: policyDefinitionsAll + AzureCloud: policyDefinitionsAzureCloud + AzureChinaCloud: policyDefinitionsAzureChinaCloud + AzureUSGovernment: policyDefinitionsAzureUSGovernment +} + +// The following var is used to compile the required Policy Definitions into a single object +var policySetDefinitionsByCloudType = { + All: policySetDefinitionsAll + AzureCloud: policySetDefinitionsAzureCloud + AzureChinaCloud: policySetDefinitionsAzureChinaCloud + AzureUSGovernment: policySetDefinitionsAzureUSGovernment +} + +// The following var is used to extract the Policy Definitions into a single list for deployment +// This will contain all policy definitions classified as available for All cloud environments, and those for the current cloud environment +var policyDefinitions = concat(policyDefinitionsByCloudType.All, policyDefinitionsByCloudType[cloudEnv]) + +// The following var is used to extract the Policy Set Definitions into a single list for deployment +// This will contain all policy set definitions classified as available for All cloud environments, and those for the current cloud environment +var policySetDefinitions = concat(policySetDefinitionsByCloudType.All, policySetDefinitionsByCloudType[cloudEnv]) + +// Create the Policy Definitions as needed for the target cloud environment +resource PolicyDefinitions 'Microsoft.Authorization/policyDefinitions@2020-09-01' = [for policy in policyDefinitions: { + name: policy.name + properties: { + description: policy.properties.description + displayName: policy.properties.displayName + metadata: policy.properties.metadata + mode: policy.properties.mode + parameters: policy.properties.parameters + policyType: policy.properties.policyType + policyRule: policy.properties.policyRule + } +}] + +// Create the Policy Definitions as needed for the target cloud environment +// Depends on Policy Definitons to ensure they exist before creating dependent Policy Set Definitions (Initiatives) +resource PolicySetDefinitions 'Microsoft.Authorization/policySetDefinitions@2020-09-01' = [for policy in policySetDefinitions: { + dependsOn: [ + PolicyDefinitions + ] + name: policy.name + properties: { + description: policy.properties.description + displayName: policy.properties.displayName + metadata: policy.properties.metadata + parameters: policy.properties.parameters + policyType: policy.properties.policyType + policyDefinitions: policy.properties.policyDefinitions + policyDefinitionGroups: policy.properties.policyDefinitionGroups + } +}] + +output policyDefinitionNames array = [for policy in policyDefinitions: policy.name] +output policySetDefinitionNames array = [for policy in policySetDefinitions: policy.name] diff --git a/patterns/alz/templates/policies-NotificationAssets.bicep b/patterns/alz/templates/policies-NotificationAssets.bicep new file mode 100644 index 000000000..ed9692da4 --- /dev/null +++ b/patterns/alz/templates/policies-NotificationAssets.bicep @@ -0,0 +1,174 @@ +targetScope = 'managementGroup' + +@metadata({ message: 'The JSON version of this file is programatically generated from Bicep. PLEASE DO NOT UPDATE MANUALLY!!' }) +@description('Provide a prefix (unique at tenant-scope) for the Management Group hierarchy and other resources created as part of an Azure landing zone. DEFAULT VALUE = "alz"') +param topLevelManagementGroupPrefix string = 'alz' + +@description('Optionally set the deployment location for policies with Deploy If Not Exists effect. DEFAULT VALUE = "deployment().location"') +param location string = deployment().location + +@description('Optionally set the scope for custom Policy Definitions used in Policy Set Definitions (Initiatives). Must be one of \'/\', \'/subscriptions/id\' or \'/providers/Microsoft.Management/managementGroups/id\'. DEFAULT VALUE = \'/providers/Microsoft.Management/managementGroups/\${topLevelManagementGroupPrefix}\'') +param scope string = tenantResourceId('Microsoft.Management/managementGroups', topLevelManagementGroupPrefix) + +// Extract the environment name to dynamically determine which policies to deploy. +var cloudEnv = environment().name + +// Default deployment locations used in templates +var defaultDeploymentLocationByCloudType = { + AzureCloud: 'northeurope' + AzureChinaCloud: 'chinaeast2' + AzureUSGovernment: 'usgovvirginia' +} + +// Used to identify template variables used in the templates for replacement. +var templateVars = { + scope: '/providers/Microsoft.Management/managementGroups/contoso' + defaultDeploymentLocation: '"location": "northeurope"' + localizedDeploymentLocation: '"location": "${defaultDeploymentLocationByCloudType[cloudEnv]}"' +} + +var targetDeploymentLocationByCloudType = { + AzureCloud: location ?? 'northeurope' + AzureChinaCloud: location ?? 'chinaeast2' + AzureUSGovernment: location ?? 'usgovvirginia' +} + +var deploymentLocation = '"location": "${targetDeploymentLocationByCloudType[cloudEnv]}"' + +// Unable to do the following commented out approach due to the error "The value must be a compile-time constant.bicep(BCP032)" +// See: https://github.com/Azure/bicep/issues/3816#issuecomment-1191230215 + +// The following vars are used to load the list of Policy Definitions to import +// var listPolicyDefinitionsAll = loadJsonContent('../data/policyDefinitions.All.json') +// var listPolicyDefinitionsAzureCloud = loadJsonContent('../data/policyDefinitions.AzureCloud.json') +// var listPolicyDefinitionsAzureChinaCloud = loadJsonContent('../data/policyDefinitions.AzureChinaCloud.json') +// var listPolicyDefinitionsAzureUSGovernment = loadJsonContent('../data/policyDefinitions.AzureUSGovernment.json') + +// The following vars are used to load the list of Policy Set Definitions to import +// var listPolicySetDefinitionsAll = loadJsonContent('../data/policySetDefinitions.All.json') +// var listPolicySetDefinitionsAzureCloud = loadJsonContent('../data/policySetDefinitions.AzureCloud.json') +// var listPolicySetDefinitionsAzureChinaCloud = loadJsonContent('../data/policySetDefinitions.AzureChinaCloud.json') +// var listPolicySetDefinitionsAzureUSGovernment = loadJsonContent('../data/policySetDefinitions.AzureUSGovernment.json') + +// The following vars are used to load the list of Policy Definitions to import +// var loadPolicyDefinitionsAll = [for item in listPolicyDefinitionsAll: loadTextContent(item)] +// var loadPolicyDefinitionsAzureCloud = [for item in listPolicyDefinitionsAzureCloud: loadTextContent(item)] +// var loadPolicyDefinitionsAzureChinaCloud = [for item in listPolicyDefinitionsAzureChinaCloud: loadTextContent(item)] +// var loadPolicyDefinitionsAzureUSGovernment = [for item in listPolicyDefinitionsAzureUSGovernment: loadTextContent(item)] + +// The following vars are used to load the list of Policy Set Definitions to import +// var loadPolicySetDefinitionsAll = [for item in listPolicySetDefinitionsAll: loadTextContent(item)] +// var loadPolicySetDefinitionsAzureCloud = [for item in listPolicySetDefinitionsAzureCloud: loadTextContent(item)] +// var loadPolicySetDefinitionsAzureChinaCloud = [for item in listPolicySetDefinitionsAzureChinaCloud: loadTextContent(item)] +// var loadPolicySetDefinitionsAzureUSGovernment = [for item in listPolicySetDefinitionsAzureUSGovernment: loadTextContent(item)] + +// The following var contains lists of files containing Policy Definition resources to load, grouped by compatibility with Cloud. +// To get a full list of Azure clouds, use the az cli command "az cloud list --output table" +// We use loadTextContent instead of loadJsonContent as this allows us to perform string replacement operations against the imported templates. +var loadPolicyDefinitions = { + All: [ + // Used in Notification-Assets policy Set Definition + loadTextContent('../../../services/AlertsManagement/actionRules/Deploy-AlertProcessingRule-Deploy.json') + loadTextContent('../../../services/AlertsManagement/actionRules/Deploy-AlertProcessingRule-Suppression.json') + ] + AzureCloud: [] + AzureChinaCloud: [] + AzureUSGovernment: [] +} + +// The following var contains lists of files containing Policy Set Definition (Initiative) resources to load, grouped by compatibility with Cloud. +// To get a full list of Azure clouds, use the az cli command "az cloud list --output table" +// We use loadTextContent instead of loadJsonContent as this allows us to perform string replacement operations against the imported templates. +// Use string(loadJsonContent('../file.json')) when the JSON has more than 131072 characters +var loadPolicySetDefinitions = { + All: [ + string(loadJsonContent('../policySetDefinitions/Deploy-Notification-Assets.json')) + ] + AzureCloud: [] + AzureChinaCloud: [] + AzureUSGovernment: [] +} + +// The following vars are used to manipulate the imported Policy Definitions to replace deployment location values +// Needs a double replace to handle updates in both templates for All clouds, and localized templates +var processPolicyDefinitionsAll = [for content in loadPolicyDefinitions.All: replace(replace(content, templateVars.defaultDeploymentLocation, deploymentLocation), templateVars.localizedDeploymentLocation, deploymentLocation)] +var processPolicyDefinitionsAzureCloud = [for content in loadPolicyDefinitions.AzureCloud: replace(replace(content, templateVars.defaultDeploymentLocation, deploymentLocation), templateVars.localizedDeploymentLocation, deploymentLocation)] +var processPolicyDefinitionsAzureChinaCloud = [for content in loadPolicyDefinitions.AzureChinaCloud: replace(replace(content, templateVars.defaultDeploymentLocation, deploymentLocation), templateVars.localizedDeploymentLocation, deploymentLocation)] +var processPolicyDefinitionsAzureUSGovernment = [for content in loadPolicyDefinitions.AzureUSGovernment: replace(replace(content, templateVars.defaultDeploymentLocation, deploymentLocation), templateVars.localizedDeploymentLocation, deploymentLocation)] + +// The following vars are used to manipulate the imported Policy Set Definitions to replace Policy Definition scope values +var processPolicySetDefinitionsAll = [for content in loadPolicySetDefinitions.All: replace(content, templateVars.scope, scope)] +var processPolicySetDefinitionsAzureCloud = [for content in loadPolicySetDefinitions.AzureCloud: replace(content, templateVars.scope, scope)] +var processPolicySetDefinitionsAzureChinaCloud = [for content in loadPolicySetDefinitions.AzureChinaCloud: replace(content, templateVars.scope, scope)] +var processPolicySetDefinitionsAzureUSGovernment = [for content in loadPolicySetDefinitions.AzureUSGovernment: replace(content, templateVars.scope, scope)] + +// The following vars are used to convert the imported Policy Definitions into objects from JSON +var policyDefinitionsAll = [for content in processPolicyDefinitionsAll: json(content)] +var policyDefinitionsAzureCloud = [for content in processPolicyDefinitionsAzureCloud: json(content)] +var policyDefinitionsAzureChinaCloud = [for content in processPolicyDefinitionsAzureChinaCloud: json(content)] +var policyDefinitionsAzureUSGovernment = [for content in processPolicyDefinitionsAzureUSGovernment: json(content)] + +// The following vars are used to convert the imported Policy Set Definitions into objects from JSON +var policySetDefinitionsAll = [for content in processPolicySetDefinitionsAll: json(content)] +var policySetDefinitionsAzureCloud = [for content in processPolicySetDefinitionsAzureCloud: json(content)] +var policySetDefinitionsAzureChinaCloud = [for content in processPolicySetDefinitionsAzureChinaCloud: json(content)] +var policySetDefinitionsAzureUSGovernment = [for content in processPolicySetDefinitionsAzureUSGovernment: json(content)] + +// The following var is used to compile the required Policy Definitions into a single object +var policyDefinitionsByCloudType = { + All: policyDefinitionsAll + AzureCloud: policyDefinitionsAzureCloud + AzureChinaCloud: policyDefinitionsAzureChinaCloud + AzureUSGovernment: policyDefinitionsAzureUSGovernment +} + +// The following var is used to compile the required Policy Definitions into a single object +var policySetDefinitionsByCloudType = { + All: policySetDefinitionsAll + AzureCloud: policySetDefinitionsAzureCloud + AzureChinaCloud: policySetDefinitionsAzureChinaCloud + AzureUSGovernment: policySetDefinitionsAzureUSGovernment +} + +// The following var is used to extract the Policy Definitions into a single list for deployment +// This will contain all policy definitions classified as available for All cloud environments, and those for the current cloud environment +var policyDefinitions = concat(policyDefinitionsByCloudType.All, policyDefinitionsByCloudType[cloudEnv]) + +// The following var is used to extract the Policy Set Definitions into a single list for deployment +// This will contain all policy set definitions classified as available for All cloud environments, and those for the current cloud environment +var policySetDefinitions = concat(policySetDefinitionsByCloudType.All, policySetDefinitionsByCloudType[cloudEnv]) + +// Create the Policy Definitions as needed for the target cloud environment +resource PolicyDefinitions 'Microsoft.Authorization/policyDefinitions@2020-09-01' = [for policy in policyDefinitions: { + name: policy.name + properties: { + description: policy.properties.description + displayName: policy.properties.displayName + metadata: policy.properties.metadata + mode: policy.properties.mode + parameters: policy.properties.parameters + policyType: policy.properties.policyType + policyRule: policy.properties.policyRule + } +}] + +// Create the Policy Definitions as needed for the target cloud environment +// Depends on Policy Definitons to ensure they exist before creating dependent Policy Set Definitions (Initiatives) +resource PolicySetDefinitions 'Microsoft.Authorization/policySetDefinitions@2020-09-01' = [for policy in policySetDefinitions: { + dependsOn: [ + PolicyDefinitions + ] + name: policy.name + properties: { + description: policy.properties.description + displayName: policy.properties.displayName + metadata: policy.properties.metadata + parameters: policy.properties.parameters + policyType: policy.properties.policyType + policyDefinitions: policy.properties.policyDefinitions + policyDefinitionGroups: policy.properties.policyDefinitionGroups + } +}] + +output policyDefinitionNames array = [for policy in policyDefinitions: policy.name] +output policySetDefinitionNames array = [for policy in policySetDefinitions: policy.name] diff --git a/patterns/alz/templates/policies-RecoveryServices.bicep b/patterns/alz/templates/policies-RecoveryServices.bicep new file mode 100644 index 000000000..a5b9f2d4d --- /dev/null +++ b/patterns/alz/templates/policies-RecoveryServices.bicep @@ -0,0 +1,173 @@ +targetScope = 'managementGroup' + +@metadata({ message: 'The JSON version of this file is programatically generated from Bicep. PLEASE DO NOT UPDATE MANUALLY!!' }) +@description('Provide a prefix (unique at tenant-scope) for the Management Group hierarchy and other resources created as part of an Azure landing zone. DEFAULT VALUE = "alz"') +param topLevelManagementGroupPrefix string = 'alz' + +@description('Optionally set the deployment location for policies with Deploy If Not Exists effect. DEFAULT VALUE = "deployment().location"') +param location string = deployment().location + +@description('Optionally set the scope for custom Policy Definitions used in Policy Set Definitions (Initiatives). Must be one of \'/\', \'/subscriptions/id\' or \'/providers/Microsoft.Management/managementGroups/id\'. DEFAULT VALUE = \'/providers/Microsoft.Management/managementGroups/\${topLevelManagementGroupPrefix}\'') +param scope string = tenantResourceId('Microsoft.Management/managementGroups', topLevelManagementGroupPrefix) + +// Extract the environment name to dynamically determine which policies to deploy. +var cloudEnv = environment().name + +// Default deployment locations used in templates +var defaultDeploymentLocationByCloudType = { + AzureCloud: 'northeurope' + AzureChinaCloud: 'chinaeast2' + AzureUSGovernment: 'usgovvirginia' +} + +// Used to identify template variables used in the templates for replacement. +var templateVars = { + scope: '/providers/Microsoft.Management/managementGroups/contoso' + defaultDeploymentLocation: '"location": "northeurope"' + localizedDeploymentLocation: '"location": "${defaultDeploymentLocationByCloudType[cloudEnv]}"' +} + +var targetDeploymentLocationByCloudType = { + AzureCloud: location ?? 'northeurope' + AzureChinaCloud: location ?? 'chinaeast2' + AzureUSGovernment: location ?? 'usgovvirginia' +} + +var deploymentLocation = '"location": "${targetDeploymentLocationByCloudType[cloudEnv]}"' + +// Unable to do the following commented out approach due to the error "The value must be a compile-time constant.bicep(BCP032)" +// See: https://github.com/Azure/bicep/issues/3816#issuecomment-1191230215 + +// The following vars are used to load the list of Policy Definitions to import +// var listPolicyDefinitionsAll = loadJsonContent('../data/policyDefinitions.All.json') +// var listPolicyDefinitionsAzureCloud = loadJsonContent('../data/policyDefinitions.AzureCloud.json') +// var listPolicyDefinitionsAzureChinaCloud = loadJsonContent('../data/policyDefinitions.AzureChinaCloud.json') +// var listPolicyDefinitionsAzureUSGovernment = loadJsonContent('../data/policyDefinitions.AzureUSGovernment.json') + +// The following vars are used to load the list of Policy Set Definitions to import +// var listPolicySetDefinitionsAll = loadJsonContent('../data/policySetDefinitions.All.json') +// var listPolicySetDefinitionsAzureCloud = loadJsonContent('../data/policySetDefinitions.AzureCloud.json') +// var listPolicySetDefinitionsAzureChinaCloud = loadJsonContent('../data/policySetDefinitions.AzureChinaCloud.json') +// var listPolicySetDefinitionsAzureUSGovernment = loadJsonContent('../data/policySetDefinitions.AzureUSGovernment.json') + +// The following vars are used to load the list of Policy Definitions to import +// var loadPolicyDefinitionsAll = [for item in listPolicyDefinitionsAll: loadTextContent(item)] +// var loadPolicyDefinitionsAzureCloud = [for item in listPolicyDefinitionsAzureCloud: loadTextContent(item)] +// var loadPolicyDefinitionsAzureChinaCloud = [for item in listPolicyDefinitionsAzureChinaCloud: loadTextContent(item)] +// var loadPolicyDefinitionsAzureUSGovernment = [for item in listPolicyDefinitionsAzureUSGovernment: loadTextContent(item)] + +// The following vars are used to load the list of Policy Set Definitions to import +// var loadPolicySetDefinitionsAll = [for item in listPolicySetDefinitionsAll: loadTextContent(item)] +// var loadPolicySetDefinitionsAzureCloud = [for item in listPolicySetDefinitionsAzureCloud: loadTextContent(item)] +// var loadPolicySetDefinitionsAzureChinaCloud = [for item in listPolicySetDefinitionsAzureChinaCloud: loadTextContent(item)] +// var loadPolicySetDefinitionsAzureUSGovernment = [for item in listPolicySetDefinitionsAzureUSGovernment: loadTextContent(item)] + +// The following var contains lists of files containing Policy Definition resources to load, grouped by compatibility with Cloud. +// To get a full list of Azure clouds, use the az cli command "az cloud list --output table" +// We use loadTextContent instead of loadJsonContent as this allows us to perform string replacement operations against the imported templates. +var loadPolicyDefinitions = { + All: [ + // Used in both RecoverySwervices and Management Policy Set Definitions + loadTextContent('../../../services/RecoveryServices/vaults/Modify-RSV-BackupHealth-Alert.json') + ] + AzureCloud: [] + AzureChinaCloud: [] + AzureUSGovernment: [] +} + +// The following var contains lists of files containing Policy Set Definition (Initiative) resources to load, grouped by compatibility with Cloud. +// To get a full list of Azure clouds, use the az cli command "az cloud list --output table" +// We use loadTextContent instead of loadJsonContent as this allows us to perform string replacement operations against the imported templates. +// Use string(loadJsonContent('../file.json')) when the JSON has more than 131072 characters +var loadPolicySetDefinitions = { + All: [ + string(loadJsonContent('../policySetDefinitions/Deploy-RecoveryServices-Alerts.json')) + ] + AzureCloud: [] + AzureChinaCloud: [] + AzureUSGovernment: [] +} + +// The following vars are used to manipulate the imported Policy Definitions to replace deployment location values +// Needs a double replace to handle updates in both templates for All clouds, and localized templates +var processPolicyDefinitionsAll = [for content in loadPolicyDefinitions.All: replace(replace(content, templateVars.defaultDeploymentLocation, deploymentLocation), templateVars.localizedDeploymentLocation, deploymentLocation)] +var processPolicyDefinitionsAzureCloud = [for content in loadPolicyDefinitions.AzureCloud: replace(replace(content, templateVars.defaultDeploymentLocation, deploymentLocation), templateVars.localizedDeploymentLocation, deploymentLocation)] +var processPolicyDefinitionsAzureChinaCloud = [for content in loadPolicyDefinitions.AzureChinaCloud: replace(replace(content, templateVars.defaultDeploymentLocation, deploymentLocation), templateVars.localizedDeploymentLocation, deploymentLocation)] +var processPolicyDefinitionsAzureUSGovernment = [for content in loadPolicyDefinitions.AzureUSGovernment: replace(replace(content, templateVars.defaultDeploymentLocation, deploymentLocation), templateVars.localizedDeploymentLocation, deploymentLocation)] + +// The following vars are used to manipulate the imported Policy Set Definitions to replace Policy Definition scope values +var processPolicySetDefinitionsAll = [for content in loadPolicySetDefinitions.All: replace(content, templateVars.scope, scope)] +var processPolicySetDefinitionsAzureCloud = [for content in loadPolicySetDefinitions.AzureCloud: replace(content, templateVars.scope, scope)] +var processPolicySetDefinitionsAzureChinaCloud = [for content in loadPolicySetDefinitions.AzureChinaCloud: replace(content, templateVars.scope, scope)] +var processPolicySetDefinitionsAzureUSGovernment = [for content in loadPolicySetDefinitions.AzureUSGovernment: replace(content, templateVars.scope, scope)] + +// The following vars are used to convert the imported Policy Definitions into objects from JSON +var policyDefinitionsAll = [for content in processPolicyDefinitionsAll: json(content)] +var policyDefinitionsAzureCloud = [for content in processPolicyDefinitionsAzureCloud: json(content)] +var policyDefinitionsAzureChinaCloud = [for content in processPolicyDefinitionsAzureChinaCloud: json(content)] +var policyDefinitionsAzureUSGovernment = [for content in processPolicyDefinitionsAzureUSGovernment: json(content)] + +// The following vars are used to convert the imported Policy Set Definitions into objects from JSON +var policySetDefinitionsAll = [for content in processPolicySetDefinitionsAll: json(content)] +var policySetDefinitionsAzureCloud = [for content in processPolicySetDefinitionsAzureCloud: json(content)] +var policySetDefinitionsAzureChinaCloud = [for content in processPolicySetDefinitionsAzureChinaCloud: json(content)] +var policySetDefinitionsAzureUSGovernment = [for content in processPolicySetDefinitionsAzureUSGovernment: json(content)] + +// The following var is used to compile the required Policy Definitions into a single object +var policyDefinitionsByCloudType = { + All: policyDefinitionsAll + AzureCloud: policyDefinitionsAzureCloud + AzureChinaCloud: policyDefinitionsAzureChinaCloud + AzureUSGovernment: policyDefinitionsAzureUSGovernment +} + +// The following var is used to compile the required Policy Definitions into a single object +var policySetDefinitionsByCloudType = { + All: policySetDefinitionsAll + AzureCloud: policySetDefinitionsAzureCloud + AzureChinaCloud: policySetDefinitionsAzureChinaCloud + AzureUSGovernment: policySetDefinitionsAzureUSGovernment +} + +// The following var is used to extract the Policy Definitions into a single list for deployment +// This will contain all policy definitions classified as available for All cloud environments, and those for the current cloud environment +var policyDefinitions = concat(policyDefinitionsByCloudType.All, policyDefinitionsByCloudType[cloudEnv]) + +// The following var is used to extract the Policy Set Definitions into a single list for deployment +// This will contain all policy set definitions classified as available for All cloud environments, and those for the current cloud environment +var policySetDefinitions = concat(policySetDefinitionsByCloudType.All, policySetDefinitionsByCloudType[cloudEnv]) + +// Create the Policy Definitions as needed for the target cloud environment +resource PolicyDefinitions 'Microsoft.Authorization/policyDefinitions@2020-09-01' = [for policy in policyDefinitions: { + name: policy.name + properties: { + description: policy.properties.description + displayName: policy.properties.displayName + metadata: policy.properties.metadata + mode: policy.properties.mode + parameters: policy.properties.parameters + policyType: policy.properties.policyType + policyRule: policy.properties.policyRule + } +}] + +// Create the Policy Definitions as needed for the target cloud environment +// Depends on Policy Definitons to ensure they exist before creating dependent Policy Set Definitions (Initiatives) +resource PolicySetDefinitions 'Microsoft.Authorization/policySetDefinitions@2020-09-01' = [for policy in policySetDefinitions: { + dependsOn: [ + PolicyDefinitions + ] + name: policy.name + properties: { + description: policy.properties.description + displayName: policy.properties.displayName + metadata: policy.properties.metadata + parameters: policy.properties.parameters + policyType: policy.properties.policyType + policyDefinitions: policy.properties.policyDefinitions + policyDefinitionGroups: policy.properties.policyDefinitionGroups + } +}] + +output policyDefinitionNames array = [for policy in policyDefinitions: policy.name] +output policySetDefinitionNames array = [for policy in policySetDefinitions: policy.name] diff --git a/patterns/alz/templates/policies-ServiceHealth.bicep b/patterns/alz/templates/policies-ServiceHealth.bicep new file mode 100644 index 000000000..e48e825ab --- /dev/null +++ b/patterns/alz/templates/policies-ServiceHealth.bicep @@ -0,0 +1,178 @@ +targetScope = 'managementGroup' + +@metadata({ message: 'The JSON version of this file is programatically generated from Bicep. PLEASE DO NOT UPDATE MANUALLY!!' }) +@description('Provide a prefix (unique at tenant-scope) for the Management Group hierarchy and other resources created as part of an Azure landing zone. DEFAULT VALUE = "alz"') +param topLevelManagementGroupPrefix string = 'alz' + +@description('Optionally set the deployment location for policies with Deploy If Not Exists effect. DEFAULT VALUE = "deployment().location"') +param location string = deployment().location + +@description('Optionally set the scope for custom Policy Definitions used in Policy Set Definitions (Initiatives). Must be one of \'/\', \'/subscriptions/id\' or \'/providers/Microsoft.Management/managementGroups/id\'. DEFAULT VALUE = \'/providers/Microsoft.Management/managementGroups/\${topLevelManagementGroupPrefix}\'') +param scope string = tenantResourceId('Microsoft.Management/managementGroups', topLevelManagementGroupPrefix) + +// Extract the environment name to dynamically determine which policies to deploy. +var cloudEnv = environment().name + +// Default deployment locations used in templates +var defaultDeploymentLocationByCloudType = { + AzureCloud: 'northeurope' + AzureChinaCloud: 'chinaeast2' + AzureUSGovernment: 'usgovvirginia' +} + +// Used to identify template variables used in the templates for replacement. +var templateVars = { + scope: '/providers/Microsoft.Management/managementGroups/contoso' + defaultDeploymentLocation: '"location": "northeurope"' + localizedDeploymentLocation: '"location": "${defaultDeploymentLocationByCloudType[cloudEnv]}"' +} + +var targetDeploymentLocationByCloudType = { + AzureCloud: location ?? 'northeurope' + AzureChinaCloud: location ?? 'chinaeast2' + AzureUSGovernment: location ?? 'usgovvirginia' +} + +var deploymentLocation = '"location": "${targetDeploymentLocationByCloudType[cloudEnv]}"' + +// Unable to do the following commented out approach due to the error "The value must be a compile-time constant.bicep(BCP032)" +// See: https://github.com/Azure/bicep/issues/3816#issuecomment-1191230215 + +// The following vars are used to load the list of Policy Definitions to import +// var listPolicyDefinitionsAll = loadJsonContent('../data/policyDefinitions.All.json') +// var listPolicyDefinitionsAzureCloud = loadJsonContent('../data/policyDefinitions.AzureCloud.json') +// var listPolicyDefinitionsAzureChinaCloud = loadJsonContent('../data/policyDefinitions.AzureChinaCloud.json') +// var listPolicyDefinitionsAzureUSGovernment = loadJsonContent('../data/policyDefinitions.AzureUSGovernment.json') + +// The following vars are used to load the list of Policy Set Definitions to import +// var listPolicySetDefinitionsAll = loadJsonContent('../data/policySetDefinitions.All.json') +// var listPolicySetDefinitionsAzureCloud = loadJsonContent('../data/policySetDefinitions.AzureCloud.json') +// var listPolicySetDefinitionsAzureChinaCloud = loadJsonContent('../data/policySetDefinitions.AzureChinaCloud.json') +// var listPolicySetDefinitionsAzureUSGovernment = loadJsonContent('../data/policySetDefinitions.AzureUSGovernment.json') + +// The following vars are used to load the list of Policy Definitions to import +// var loadPolicyDefinitionsAll = [for item in listPolicyDefinitionsAll: loadTextContent(item)] +// var loadPolicyDefinitionsAzureCloud = [for item in listPolicyDefinitionsAzureCloud: loadTextContent(item)] +// var loadPolicyDefinitionsAzureChinaCloud = [for item in listPolicyDefinitionsAzureChinaCloud: loadTextContent(item)] +// var loadPolicyDefinitionsAzureUSGovernment = [for item in listPolicyDefinitionsAzureUSGovernment: loadTextContent(item)] + +// The following vars are used to load the list of Policy Set Definitions to import +// var loadPolicySetDefinitionsAll = [for item in listPolicySetDefinitionsAll: loadTextContent(item)] +// var loadPolicySetDefinitionsAzureCloud = [for item in listPolicySetDefinitionsAzureCloud: loadTextContent(item)] +// var loadPolicySetDefinitionsAzureChinaCloud = [for item in listPolicySetDefinitionsAzureChinaCloud: loadTextContent(item)] +// var loadPolicySetDefinitionsAzureUSGovernment = [for item in listPolicySetDefinitionsAzureUSGovernment: loadTextContent(item)] + +// The following var contains lists of files containing Policy Definition resources to load, grouped by compatibility with Cloud. +// To get a full list of Azure clouds, use the az cli command "az cloud list --output table" +// We use loadTextContent instead of loadJsonContent as this allows us to perform string replacement operations against the imported templates. +var loadPolicyDefinitions = { + All: [ + // Used in ServiceHealth Policy Set Definition + loadTextContent('../../../services/Resources/subscriptions/Deploy-ServiceHealth-ActionGroups.json') + loadTextContent('../../../services/Resources/subscriptions/Deploy-ActivityLog-ResourceHealth-UnHealthly-Alert.json') + loadTextContent('../../../services/Resources/subscriptions/Deploy-ActivityLog-ServiceHealth-Health.json') + loadTextContent('../../../services/Resources/subscriptions/Deploy-ActivityLog-ServiceHealth-Incident.json') + loadTextContent('../../../services/Resources/subscriptions/Deploy-ActivityLog-ServiceHealth-Maintenance.json') + loadTextContent('../../../services/Resources/subscriptions/Deploy-ActivityLog-ServiceHealth-Security.json') + ] + AzureCloud: [] + AzureChinaCloud: [] + AzureUSGovernment: [] +} + +// The following var contains lists of files containing Policy Set Definition (Initiative) resources to load, grouped by compatibility with Cloud. +// To get a full list of Azure clouds, use the az cli command "az cloud list --output table" +// We use loadTextContent instead of loadJsonContent as this allows us to perform string replacement operations against the imported templates. +// Use string(loadJsonContent('../file.json')) when the JSON has more than 131072 characters +var loadPolicySetDefinitions = { + All: [ + string(loadJsonContent('../policySetDefinitions/Deploy-ServiceHealth-Alerts.json')) + ] + AzureCloud: [] + AzureChinaCloud: [] + AzureUSGovernment: [] +} + +// The following vars are used to manipulate the imported Policy Definitions to replace deployment location values +// Needs a double replace to handle updates in both templates for All clouds, and localized templates +var processPolicyDefinitionsAll = [for content in loadPolicyDefinitions.All: replace(replace(content, templateVars.defaultDeploymentLocation, deploymentLocation), templateVars.localizedDeploymentLocation, deploymentLocation)] +var processPolicyDefinitionsAzureCloud = [for content in loadPolicyDefinitions.AzureCloud: replace(replace(content, templateVars.defaultDeploymentLocation, deploymentLocation), templateVars.localizedDeploymentLocation, deploymentLocation)] +var processPolicyDefinitionsAzureChinaCloud = [for content in loadPolicyDefinitions.AzureChinaCloud: replace(replace(content, templateVars.defaultDeploymentLocation, deploymentLocation), templateVars.localizedDeploymentLocation, deploymentLocation)] +var processPolicyDefinitionsAzureUSGovernment = [for content in loadPolicyDefinitions.AzureUSGovernment: replace(replace(content, templateVars.defaultDeploymentLocation, deploymentLocation), templateVars.localizedDeploymentLocation, deploymentLocation)] + +// The following vars are used to manipulate the imported Policy Set Definitions to replace Policy Definition scope values +var processPolicySetDefinitionsAll = [for content in loadPolicySetDefinitions.All: replace(content, templateVars.scope, scope)] +var processPolicySetDefinitionsAzureCloud = [for content in loadPolicySetDefinitions.AzureCloud: replace(content, templateVars.scope, scope)] +var processPolicySetDefinitionsAzureChinaCloud = [for content in loadPolicySetDefinitions.AzureChinaCloud: replace(content, templateVars.scope, scope)] +var processPolicySetDefinitionsAzureUSGovernment = [for content in loadPolicySetDefinitions.AzureUSGovernment: replace(content, templateVars.scope, scope)] + +// The following vars are used to convert the imported Policy Definitions into objects from JSON +var policyDefinitionsAll = [for content in processPolicyDefinitionsAll: json(content)] +var policyDefinitionsAzureCloud = [for content in processPolicyDefinitionsAzureCloud: json(content)] +var policyDefinitionsAzureChinaCloud = [for content in processPolicyDefinitionsAzureChinaCloud: json(content)] +var policyDefinitionsAzureUSGovernment = [for content in processPolicyDefinitionsAzureUSGovernment: json(content)] + +// The following vars are used to convert the imported Policy Set Definitions into objects from JSON +var policySetDefinitionsAll = [for content in processPolicySetDefinitionsAll: json(content)] +var policySetDefinitionsAzureCloud = [for content in processPolicySetDefinitionsAzureCloud: json(content)] +var policySetDefinitionsAzureChinaCloud = [for content in processPolicySetDefinitionsAzureChinaCloud: json(content)] +var policySetDefinitionsAzureUSGovernment = [for content in processPolicySetDefinitionsAzureUSGovernment: json(content)] + +// The following var is used to compile the required Policy Definitions into a single object +var policyDefinitionsByCloudType = { + All: policyDefinitionsAll + AzureCloud: policyDefinitionsAzureCloud + AzureChinaCloud: policyDefinitionsAzureChinaCloud + AzureUSGovernment: policyDefinitionsAzureUSGovernment +} + +// The following var is used to compile the required Policy Definitions into a single object +var policySetDefinitionsByCloudType = { + All: policySetDefinitionsAll + AzureCloud: policySetDefinitionsAzureCloud + AzureChinaCloud: policySetDefinitionsAzureChinaCloud + AzureUSGovernment: policySetDefinitionsAzureUSGovernment +} + +// The following var is used to extract the Policy Definitions into a single list for deployment +// This will contain all policy definitions classified as available for All cloud environments, and those for the current cloud environment +var policyDefinitions = concat(policyDefinitionsByCloudType.All, policyDefinitionsByCloudType[cloudEnv]) + +// The following var is used to extract the Policy Set Definitions into a single list for deployment +// This will contain all policy set definitions classified as available for All cloud environments, and those for the current cloud environment +var policySetDefinitions = concat(policySetDefinitionsByCloudType.All, policySetDefinitionsByCloudType[cloudEnv]) + +// Create the Policy Definitions as needed for the target cloud environment +resource PolicyDefinitions 'Microsoft.Authorization/policyDefinitions@2020-09-01' = [for policy in policyDefinitions: { + name: policy.name + properties: { + description: policy.properties.description + displayName: policy.properties.displayName + metadata: policy.properties.metadata + mode: policy.properties.mode + parameters: policy.properties.parameters + policyType: policy.properties.policyType + policyRule: policy.properties.policyRule + } +}] + +// Create the Policy Definitions as needed for the target cloud environment +// Depends on Policy Definitons to ensure they exist before creating dependent Policy Set Definitions (Initiatives) +resource PolicySetDefinitions 'Microsoft.Authorization/policySetDefinitions@2020-09-01' = [for policy in policySetDefinitions: { + dependsOn: [ + PolicyDefinitions + ] + name: policy.name + properties: { + description: policy.properties.description + displayName: policy.properties.displayName + metadata: policy.properties.metadata + parameters: policy.properties.parameters + policyType: policy.properties.policyType + policyDefinitions: policy.properties.policyDefinitions + policyDefinitionGroups: policy.properties.policyDefinitionGroups + } +}] + +output policyDefinitionNames array = [for policy in policyDefinitions: policy.name] +output policySetDefinitionNames array = [for policy in policySetDefinitions: policy.name] diff --git a/patterns/alz/templates/policies-Storage.bicep b/patterns/alz/templates/policies-Storage.bicep new file mode 100644 index 000000000..d31a95e7c --- /dev/null +++ b/patterns/alz/templates/policies-Storage.bicep @@ -0,0 +1,174 @@ +targetScope = 'managementGroup' + +@metadata({ message: 'The JSON version of this file is programatically generated from Bicep. PLEASE DO NOT UPDATE MANUALLY!!' }) +@description('Provide a prefix (unique at tenant-scope) for the Management Group hierarchy and other resources created as part of an Azure landing zone. DEFAULT VALUE = "alz"') +param topLevelManagementGroupPrefix string = 'alz' + +@description('Optionally set the deployment location for policies with Deploy If Not Exists effect. DEFAULT VALUE = "deployment().location"') +param location string = deployment().location + +@description('Optionally set the scope for custom Policy Definitions used in Policy Set Definitions (Initiatives). Must be one of \'/\', \'/subscriptions/id\' or \'/providers/Microsoft.Management/managementGroups/id\'. DEFAULT VALUE = \'/providers/Microsoft.Management/managementGroups/\${topLevelManagementGroupPrefix}\'') +param scope string = tenantResourceId('Microsoft.Management/managementGroups', topLevelManagementGroupPrefix) + +// Extract the environment name to dynamically determine which policies to deploy. +var cloudEnv = environment().name + +// Default deployment locations used in templates +var defaultDeploymentLocationByCloudType = { + AzureCloud: 'northeurope' + AzureChinaCloud: 'chinaeast2' + AzureUSGovernment: 'usgovvirginia' +} + +// Used to identify template variables used in the templates for replacement. +var templateVars = { + scope: '/providers/Microsoft.Management/managementGroups/contoso' + defaultDeploymentLocation: '"location": "northeurope"' + localizedDeploymentLocation: '"location": "${defaultDeploymentLocationByCloudType[cloudEnv]}"' +} + +var targetDeploymentLocationByCloudType = { + AzureCloud: location ?? 'northeurope' + AzureChinaCloud: location ?? 'chinaeast2' + AzureUSGovernment: location ?? 'usgovvirginia' +} + +var deploymentLocation = '"location": "${targetDeploymentLocationByCloudType[cloudEnv]}"' + +// Unable to do the following commented out approach due to the error "The value must be a compile-time constant.bicep(BCP032)" +// See: https://github.com/Azure/bicep/issues/3816#issuecomment-1191230215 + +// The following vars are used to load the list of Policy Definitions to import +// var listPolicyDefinitionsAll = loadJsonContent('../data/policyDefinitions.All.json') +// var listPolicyDefinitionsAzureCloud = loadJsonContent('../data/policyDefinitions.AzureCloud.json') +// var listPolicyDefinitionsAzureChinaCloud = loadJsonContent('../data/policyDefinitions.AzureChinaCloud.json') +// var listPolicyDefinitionsAzureUSGovernment = loadJsonContent('../data/policyDefinitions.AzureUSGovernment.json') + +// The following vars are used to load the list of Policy Set Definitions to import +// var listPolicySetDefinitionsAll = loadJsonContent('../data/policySetDefinitions.All.json') +// var listPolicySetDefinitionsAzureCloud = loadJsonContent('../data/policySetDefinitions.AzureCloud.json') +// var listPolicySetDefinitionsAzureChinaCloud = loadJsonContent('../data/policySetDefinitions.AzureChinaCloud.json') +// var listPolicySetDefinitionsAzureUSGovernment = loadJsonContent('../data/policySetDefinitions.AzureUSGovernment.json') + +// The following vars are used to load the list of Policy Definitions to import +// var loadPolicyDefinitionsAll = [for item in listPolicyDefinitionsAll: loadTextContent(item)] +// var loadPolicyDefinitionsAzureCloud = [for item in listPolicyDefinitionsAzureCloud: loadTextContent(item)] +// var loadPolicyDefinitionsAzureChinaCloud = [for item in listPolicyDefinitionsAzureChinaCloud: loadTextContent(item)] +// var loadPolicyDefinitionsAzureUSGovernment = [for item in listPolicyDefinitionsAzureUSGovernment: loadTextContent(item)] + +// The following vars are used to load the list of Policy Set Definitions to import +// var loadPolicySetDefinitionsAll = [for item in listPolicySetDefinitionsAll: loadTextContent(item)] +// var loadPolicySetDefinitionsAzureCloud = [for item in listPolicySetDefinitionsAzureCloud: loadTextContent(item)] +// var loadPolicySetDefinitionsAzureChinaCloud = [for item in listPolicySetDefinitionsAzureChinaCloud: loadTextContent(item)] +// var loadPolicySetDefinitionsAzureUSGovernment = [for item in listPolicySetDefinitionsAzureUSGovernment: loadTextContent(item)] + +// The following var contains lists of files containing Policy Definition resources to load, grouped by compatibility with Cloud. +// To get a full list of Azure clouds, use the az cli command "az cloud list --output table" +// We use loadTextContent instead of loadJsonContent as this allows us to perform string replacement operations against the imported templates. +var loadPolicyDefinitions = { + All: [ + // Used in both Storage and Management Policy Set Definitions + loadTextContent('../../../services/Storage/storageAccounts/Deploy-SA-Availability-Alert.json') + loadTextContent('../../../services/Storage/storageAccounts/Deploy-ActivityLog-SA-Delete-Alert.json') + ] + AzureCloud: [] + AzureChinaCloud: [] + AzureUSGovernment: [] +} + +// The following var contains lists of files containing Policy Set Definition (Initiative) resources to load, grouped by compatibility with Cloud. +// To get a full list of Azure clouds, use the az cli command "az cloud list --output table" +// We use loadTextContent instead of loadJsonContent as this allows us to perform string replacement operations against the imported templates. +// Use string(loadJsonContent('../file.json')) when the JSON has more than 131072 characters +var loadPolicySetDefinitions = { + All: [ + string(loadJsonContent('../policySetDefinitions/Deploy-Storage-Alerts.json')) + ] + AzureCloud: [] + AzureChinaCloud: [] + AzureUSGovernment: [] +} + +// The following vars are used to manipulate the imported Policy Definitions to replace deployment location values +// Needs a double replace to handle updates in both templates for All clouds, and localized templates +var processPolicyDefinitionsAll = [for content in loadPolicyDefinitions.All: replace(replace(content, templateVars.defaultDeploymentLocation, deploymentLocation), templateVars.localizedDeploymentLocation, deploymentLocation)] +var processPolicyDefinitionsAzureCloud = [for content in loadPolicyDefinitions.AzureCloud: replace(replace(content, templateVars.defaultDeploymentLocation, deploymentLocation), templateVars.localizedDeploymentLocation, deploymentLocation)] +var processPolicyDefinitionsAzureChinaCloud = [for content in loadPolicyDefinitions.AzureChinaCloud: replace(replace(content, templateVars.defaultDeploymentLocation, deploymentLocation), templateVars.localizedDeploymentLocation, deploymentLocation)] +var processPolicyDefinitionsAzureUSGovernment = [for content in loadPolicyDefinitions.AzureUSGovernment: replace(replace(content, templateVars.defaultDeploymentLocation, deploymentLocation), templateVars.localizedDeploymentLocation, deploymentLocation)] + +// The following vars are used to manipulate the imported Policy Set Definitions to replace Policy Definition scope values +var processPolicySetDefinitionsAll = [for content in loadPolicySetDefinitions.All: replace(content, templateVars.scope, scope)] +var processPolicySetDefinitionsAzureCloud = [for content in loadPolicySetDefinitions.AzureCloud: replace(content, templateVars.scope, scope)] +var processPolicySetDefinitionsAzureChinaCloud = [for content in loadPolicySetDefinitions.AzureChinaCloud: replace(content, templateVars.scope, scope)] +var processPolicySetDefinitionsAzureUSGovernment = [for content in loadPolicySetDefinitions.AzureUSGovernment: replace(content, templateVars.scope, scope)] + +// The following vars are used to convert the imported Policy Definitions into objects from JSON +var policyDefinitionsAll = [for content in processPolicyDefinitionsAll: json(content)] +var policyDefinitionsAzureCloud = [for content in processPolicyDefinitionsAzureCloud: json(content)] +var policyDefinitionsAzureChinaCloud = [for content in processPolicyDefinitionsAzureChinaCloud: json(content)] +var policyDefinitionsAzureUSGovernment = [for content in processPolicyDefinitionsAzureUSGovernment: json(content)] + +// The following vars are used to convert the imported Policy Set Definitions into objects from JSON +var policySetDefinitionsAll = [for content in processPolicySetDefinitionsAll: json(content)] +var policySetDefinitionsAzureCloud = [for content in processPolicySetDefinitionsAzureCloud: json(content)] +var policySetDefinitionsAzureChinaCloud = [for content in processPolicySetDefinitionsAzureChinaCloud: json(content)] +var policySetDefinitionsAzureUSGovernment = [for content in processPolicySetDefinitionsAzureUSGovernment: json(content)] + +// The following var is used to compile the required Policy Definitions into a single object +var policyDefinitionsByCloudType = { + All: policyDefinitionsAll + AzureCloud: policyDefinitionsAzureCloud + AzureChinaCloud: policyDefinitionsAzureChinaCloud + AzureUSGovernment: policyDefinitionsAzureUSGovernment +} + +// The following var is used to compile the required Policy Definitions into a single object +var policySetDefinitionsByCloudType = { + All: policySetDefinitionsAll + AzureCloud: policySetDefinitionsAzureCloud + AzureChinaCloud: policySetDefinitionsAzureChinaCloud + AzureUSGovernment: policySetDefinitionsAzureUSGovernment +} + +// The following var is used to extract the Policy Definitions into a single list for deployment +// This will contain all policy definitions classified as available for All cloud environments, and those for the current cloud environment +var policyDefinitions = concat(policyDefinitionsByCloudType.All, policyDefinitionsByCloudType[cloudEnv]) + +// The following var is used to extract the Policy Set Definitions into a single list for deployment +// This will contain all policy set definitions classified as available for All cloud environments, and those for the current cloud environment +var policySetDefinitions = concat(policySetDefinitionsByCloudType.All, policySetDefinitionsByCloudType[cloudEnv]) + +// Create the Policy Definitions as needed for the target cloud environment +resource PolicyDefinitions 'Microsoft.Authorization/policyDefinitions@2020-09-01' = [for policy in policyDefinitions: { + name: policy.name + properties: { + description: policy.properties.description + displayName: policy.properties.displayName + metadata: policy.properties.metadata + mode: policy.properties.mode + parameters: policy.properties.parameters + policyType: policy.properties.policyType + policyRule: policy.properties.policyRule + } +}] + +// Create the Policy Definitions as needed for the target cloud environment +// Depends on Policy Definitons to ensure they exist before creating dependent Policy Set Definitions (Initiatives) +resource PolicySetDefinitions 'Microsoft.Authorization/policySetDefinitions@2020-09-01' = [for policy in policySetDefinitions: { + dependsOn: [ + PolicyDefinitions + ] + name: policy.name + properties: { + description: policy.properties.description + displayName: policy.properties.displayName + metadata: policy.properties.metadata + parameters: policy.properties.parameters + policyType: policy.properties.policyType + policyDefinitions: policy.properties.policyDefinitions + policyDefinitionGroups: policy.properties.policyDefinitionGroups + } +}] + +output policyDefinitionNames array = [for policy in policyDefinitions: policy.name] +output policySetDefinitionNames array = [for policy in policySetDefinitions: policy.name] diff --git a/patterns/alz/templates/policies-Web.bicep b/patterns/alz/templates/policies-Web.bicep new file mode 100644 index 000000000..76bd9b953 --- /dev/null +++ b/patterns/alz/templates/policies-Web.bicep @@ -0,0 +1,176 @@ +targetScope = 'managementGroup' + +@metadata({ message: 'The JSON version of this file is programatically generated from Bicep. PLEASE DO NOT UPDATE MANUALLY!!' }) +@description('Provide a prefix (unique at tenant-scope) for the Management Group hierarchy and other resources created as part of an Azure landing zone. DEFAULT VALUE = "alz"') +param topLevelManagementGroupPrefix string = 'alz' + +@description('Optionally set the deployment location for policies with Deploy If Not Exists effect. DEFAULT VALUE = "deployment().location"') +param location string = deployment().location + +@description('Optionally set the scope for custom Policy Definitions used in Policy Set Definitions (Initiatives). Must be one of \'/\', \'/subscriptions/id\' or \'/providers/Microsoft.Management/managementGroups/id\'. DEFAULT VALUE = \'/providers/Microsoft.Management/managementGroups/\${topLevelManagementGroupPrefix}\'') +param scope string = tenantResourceId('Microsoft.Management/managementGroups', topLevelManagementGroupPrefix) + +// Extract the environment name to dynamically determine which policies to deploy. +var cloudEnv = environment().name + +// Default deployment locations used in templates +var defaultDeploymentLocationByCloudType = { + AzureCloud: 'northeurope' + AzureChinaCloud: 'chinaeast2' + AzureUSGovernment: 'usgovvirginia' +} + +// Used to identify template variables used in the templates for replacement. +var templateVars = { + scope: '/providers/Microsoft.Management/managementGroups/contoso' + defaultDeploymentLocation: '"location": "northeurope"' + localizedDeploymentLocation: '"location": "${defaultDeploymentLocationByCloudType[cloudEnv]}"' +} + +var targetDeploymentLocationByCloudType = { + AzureCloud: location ?? 'northeurope' + AzureChinaCloud: location ?? 'chinaeast2' + AzureUSGovernment: location ?? 'usgovvirginia' +} + +var deploymentLocation = '"location": "${targetDeploymentLocationByCloudType[cloudEnv]}"' + +// Unable to do the following commented out approach due to the error "The value must be a compile-time constant.bicep(BCP032)" +// See: https://github.com/Azure/bicep/issues/3816#issuecomment-1191230215 + +// The following vars are used to load the list of Policy Definitions to import +// var listPolicyDefinitionsAll = loadJsonContent('../data/policyDefinitions.All.json') +// var listPolicyDefinitionsAzureCloud = loadJsonContent('../data/policyDefinitions.AzureCloud.json') +// var listPolicyDefinitionsAzureChinaCloud = loadJsonContent('../data/policyDefinitions.AzureChinaCloud.json') +// var listPolicyDefinitionsAzureUSGovernment = loadJsonContent('../data/policyDefinitions.AzureUSGovernment.json') + +// The following vars are used to load the list of Policy Set Definitions to import +// var listPolicySetDefinitionsAll = loadJsonContent('../data/policySetDefinitions.All.json') +// var listPolicySetDefinitionsAzureCloud = loadJsonContent('../data/policySetDefinitions.AzureCloud.json') +// var listPolicySetDefinitionsAzureChinaCloud = loadJsonContent('../data/policySetDefinitions.AzureChinaCloud.json') +// var listPolicySetDefinitionsAzureUSGovernment = loadJsonContent('../data/policySetDefinitions.AzureUSGovernment.json') + +// The following vars are used to load the list of Policy Definitions to import +// var loadPolicyDefinitionsAll = [for item in listPolicyDefinitionsAll: loadTextContent(item)] +// var loadPolicyDefinitionsAzureCloud = [for item in listPolicyDefinitionsAzureCloud: loadTextContent(item)] +// var loadPolicyDefinitionsAzureChinaCloud = [for item in listPolicyDefinitionsAzureChinaCloud: loadTextContent(item)] +// var loadPolicyDefinitionsAzureUSGovernment = [for item in listPolicyDefinitionsAzureUSGovernment: loadTextContent(item)] + +// The following vars are used to load the list of Policy Set Definitions to import +// var loadPolicySetDefinitionsAll = [for item in listPolicySetDefinitionsAll: loadTextContent(item)] +// var loadPolicySetDefinitionsAzureCloud = [for item in listPolicySetDefinitionsAzureCloud: loadTextContent(item)] +// var loadPolicySetDefinitionsAzureChinaCloud = [for item in listPolicySetDefinitionsAzureChinaCloud: loadTextContent(item)] +// var loadPolicySetDefinitionsAzureUSGovernment = [for item in listPolicySetDefinitionsAzureUSGovernment: loadTextContent(item)] + +// The following var contains lists of files containing Policy Definition resources to load, grouped by compatibility with Cloud. +// To get a full list of Azure clouds, use the az cli command "az cloud list --output table" +// We use loadTextContent instead of loadJsonContent as this allows us to perform string replacement operations against the imported templates. +var loadPolicyDefinitions = { + All: [ + // Used in Web Policy Set Definition + loadTextContent('../../../services/Web/serverFarms/Deploy-WSF-CPUPercentage-Alert.json') + loadTextContent('../../../services/Web/serverFarms/Deploy-WSF-DiskQueueLength-Alert.json') + loadTextContent('../../../services/Web/serverFarms/Deploy-WSF-HttpQueueLength-Alert.json') + loadTextContent('../../../services/Web/serverFarms/Deploy-WSF-MemoryPercentage-Alert.json') + ] + AzureCloud: [] + AzureChinaCloud: [] + AzureUSGovernment: [] +} + +// The following var contains lists of files containing Policy Set Definition (Initiative) resources to load, grouped by compatibility with Cloud. +// To get a full list of Azure clouds, use the az cli command "az cloud list --output table" +// We use loadTextContent instead of loadJsonContent as this allows us to perform string replacement operations against the imported templates. +// Use string(loadJsonContent('../file.json')) when the JSON has more than 131072 characters +var loadPolicySetDefinitions = { + All: [ + string(loadJsonContent('../policySetDefinitions/Deploy-Web-Alerts.json')) + ] + AzureCloud: [] + AzureChinaCloud: [] + AzureUSGovernment: [] +} + +// The following vars are used to manipulate the imported Policy Definitions to replace deployment location values +// Needs a double replace to handle updates in both templates for All clouds, and localized templates +var processPolicyDefinitionsAll = [for content in loadPolicyDefinitions.All: replace(replace(content, templateVars.defaultDeploymentLocation, deploymentLocation), templateVars.localizedDeploymentLocation, deploymentLocation)] +var processPolicyDefinitionsAzureCloud = [for content in loadPolicyDefinitions.AzureCloud: replace(replace(content, templateVars.defaultDeploymentLocation, deploymentLocation), templateVars.localizedDeploymentLocation, deploymentLocation)] +var processPolicyDefinitionsAzureChinaCloud = [for content in loadPolicyDefinitions.AzureChinaCloud: replace(replace(content, templateVars.defaultDeploymentLocation, deploymentLocation), templateVars.localizedDeploymentLocation, deploymentLocation)] +var processPolicyDefinitionsAzureUSGovernment = [for content in loadPolicyDefinitions.AzureUSGovernment: replace(replace(content, templateVars.defaultDeploymentLocation, deploymentLocation), templateVars.localizedDeploymentLocation, deploymentLocation)] + +// The following vars are used to manipulate the imported Policy Set Definitions to replace Policy Definition scope values +var processPolicySetDefinitionsAll = [for content in loadPolicySetDefinitions.All: replace(content, templateVars.scope, scope)] +var processPolicySetDefinitionsAzureCloud = [for content in loadPolicySetDefinitions.AzureCloud: replace(content, templateVars.scope, scope)] +var processPolicySetDefinitionsAzureChinaCloud = [for content in loadPolicySetDefinitions.AzureChinaCloud: replace(content, templateVars.scope, scope)] +var processPolicySetDefinitionsAzureUSGovernment = [for content in loadPolicySetDefinitions.AzureUSGovernment: replace(content, templateVars.scope, scope)] + +// The following vars are used to convert the imported Policy Definitions into objects from JSON +var policyDefinitionsAll = [for content in processPolicyDefinitionsAll: json(content)] +var policyDefinitionsAzureCloud = [for content in processPolicyDefinitionsAzureCloud: json(content)] +var policyDefinitionsAzureChinaCloud = [for content in processPolicyDefinitionsAzureChinaCloud: json(content)] +var policyDefinitionsAzureUSGovernment = [for content in processPolicyDefinitionsAzureUSGovernment: json(content)] + +// The following vars are used to convert the imported Policy Set Definitions into objects from JSON +var policySetDefinitionsAll = [for content in processPolicySetDefinitionsAll: json(content)] +var policySetDefinitionsAzureCloud = [for content in processPolicySetDefinitionsAzureCloud: json(content)] +var policySetDefinitionsAzureChinaCloud = [for content in processPolicySetDefinitionsAzureChinaCloud: json(content)] +var policySetDefinitionsAzureUSGovernment = [for content in processPolicySetDefinitionsAzureUSGovernment: json(content)] + +// The following var is used to compile the required Policy Definitions into a single object +var policyDefinitionsByCloudType = { + All: policyDefinitionsAll + AzureCloud: policyDefinitionsAzureCloud + AzureChinaCloud: policyDefinitionsAzureChinaCloud + AzureUSGovernment: policyDefinitionsAzureUSGovernment +} + +// The following var is used to compile the required Policy Definitions into a single object +var policySetDefinitionsByCloudType = { + All: policySetDefinitionsAll + AzureCloud: policySetDefinitionsAzureCloud + AzureChinaCloud: policySetDefinitionsAzureChinaCloud + AzureUSGovernment: policySetDefinitionsAzureUSGovernment +} + +// The following var is used to extract the Policy Definitions into a single list for deployment +// This will contain all policy definitions classified as available for All cloud environments, and those for the current cloud environment +var policyDefinitions = concat(policyDefinitionsByCloudType.All, policyDefinitionsByCloudType[cloudEnv]) + +// The following var is used to extract the Policy Set Definitions into a single list for deployment +// This will contain all policy set definitions classified as available for All cloud environments, and those for the current cloud environment +var policySetDefinitions = concat(policySetDefinitionsByCloudType.All, policySetDefinitionsByCloudType[cloudEnv]) + +// Create the Policy Definitions as needed for the target cloud environment +resource PolicyDefinitions 'Microsoft.Authorization/policyDefinitions@2020-09-01' = [for policy in policyDefinitions: { + name: policy.name + properties: { + description: policy.properties.description + displayName: policy.properties.displayName + metadata: policy.properties.metadata + mode: policy.properties.mode + parameters: policy.properties.parameters + policyType: policy.properties.policyType + policyRule: policy.properties.policyRule + } +}] + +// Create the Policy Definitions as needed for the target cloud environment +// Depends on Policy Definitons to ensure they exist before creating dependent Policy Set Definitions (Initiatives) +resource PolicySetDefinitions 'Microsoft.Authorization/policySetDefinitions@2020-09-01' = [for policy in policySetDefinitions: { + dependsOn: [ + PolicyDefinitions + ] + name: policy.name + properties: { + description: policy.properties.description + displayName: policy.properties.displayName + metadata: policy.properties.metadata + parameters: policy.properties.parameters + policyType: policy.properties.policyType + policyDefinitions: policy.properties.policyDefinitions + policyDefinitionGroups: policy.properties.policyDefinitionGroups + } +}] + +output policyDefinitionNames array = [for policy in policyDefinitions: policy.name] +output policySetDefinitionNames array = [for policy in policySetDefinitions: policy.name] diff --git a/patterns/alz/templates/policies.bicep b/patterns/alz/templates/policies.bicep index 7b3f709da..73c3252c8 100644 --- a/patterns/alz/templates/policies.bicep +++ b/patterns/alz/templates/policies.bicep @@ -127,12 +127,12 @@ var loadPolicyDefinitions = { loadTextContent('../../../services/Cdn/profiles/Deploy-CDNP-OriginLatency-Alert.json') loadTextContent('../../../services/Cdn/profiles/Deploy-CDNP-Percentage4XX-Alert.json') loadTextContent('../../../services/Cdn/profiles/Deploy-CDNP-Percentage5XX-Alert.json') - loadTextContent('../../../services/Compute/virtualMachines/Deploy-VM-AvailableMemory-Alert.json') + //loadTextContent('../../../services/Compute/virtualMachines/Deploy-VM-AvailableMemory-Alert.json') loadTextContent('../../../services/Compute/virtualMachines/Deploy-VM-DataDiskReadLatency-Alert.json') loadTextContent('../../../services/Compute/virtualMachines/Deploy-VM-DataDiskSpace-Alert.json') loadTextContent('../../../services/Compute/virtualMachines/Deploy-VM-DataDiskWriteLatency-Alert.json') loadTextContent('../../../services/Compute/virtualMachines/Deploy-VM-HeartBeat-Alert.json') - loadTextContent('../../../services/Compute/virtualMachines/Deploy-VM-HeartBeatAlertRG.json') + //loadTextContent('../../../services/Compute/virtualMachines/Deploy-VM-HeartBeatAlertRG.json') loadTextContent('../../../services/Compute/virtualMachines/Deploy-VM-NetworkIn-Alert.json') loadTextContent('../../../services/Compute/virtualMachines/Deploy-VM-NetworkOut-Alert.json') loadTextContent('../../../services/Compute/virtualMachines/Deploy-VM-OSDiskReadLatency-Alert.json') @@ -162,26 +162,11 @@ var loadPolicyDefinitions = { loadTextContent('../../../services/Network/publicIPAddresses/Deploy-PIP-VIPAvailability-Alert.json') loadTextContent('../../../services/Network/virtualNetworks/Deploy-VNET-DDOSAttack-Alert.json') - // Used in LandingZoneHybrid policy definitions only - loadTextContent('../../../services/HybridCompute/machines/Deploy-Hybrid-VM-AvailableMemory-Alert.json') - loadTextContent('../../../services/HybridCompute/machines/Deploy-Hybrid-VM-DataDiskReadLatency-Alert.json') - loadTextContent('../../../services/HybridCompute/machines/Deploy-Hybrid-VM-DataDiskSpace-Alert.json') - loadTextContent('../../../services/HybridCompute/machines/Deploy-Hybrid-VM-DataDiskWriteLatency-Alert.json') - loadTextContent('../../../services/HybridCompute/machines/Deploy-Hybrid-VM-HeartBeat-Alert.json') - loadTextContent('../../../services/HybridCompute/machines/Deploy-Hybrid-VM-HeartBeatAlertRG.json') - loadTextContent('../../../services/HybridCompute/machines/Deploy-Hybrid-VM-NetworkIn-Alert.json') - loadTextContent('../../../services/HybridCompute/machines/Deploy-Hybrid-VM-NetworkOut-Alert.json') - loadTextContent('../../../services/HybridCompute/machines/Deploy-Hybrid-VM-OSDiskReadLatency-Alert.json') - loadTextContent('../../../services/HybridCompute/machines/Deploy-Hybrid-VM-OSDiskSpace-Alert.json') - loadTextContent('../../../services/HybridCompute/machines/Deploy-Hybrid-VM-OSDiskWriteLatency-Alert.json') - loadTextContent('../../../services/HybridCompute/machines/Deploy-Hybrid-VM-PercentCPU-Alert.json') - loadTextContent('../../../services/HybridCompute/machines/Deploy-Hybrid-VM-PercentMemory-Alert.json') - loadTextContent('../../../services/HybridCompute/machines/Deploy-Hybrid-VM-Disconnected-Alert.json') - // Used in Management policy definitions only loadTextContent('../../../services/Automation/automationAccounts/Deploy-AA-TotalJob-Alert.json') loadTextContent('../../../services/OperationalInsights/workspaces/Deploy-ActivityLog-LAWorkspace-Del.json') loadTextContent('../../../services/OperationalInsights/workspaces/Deploy-ActivityLog-LAWorkspace-KeyRegen.json') + loadTextContent('../../../services/OperationalInsights/workspaces/Deploy-LAWorkspace-DailyCapLimitReached-Alert.json') // Used in both LandingZone and Management policy definitions loadTextContent('../../../services/storage/storageAccounts/Deploy-SA-Availability-Alert.json') @@ -217,7 +202,6 @@ var loadPolicySetDefinitions = { string(loadJsonContent('../policySetDefinitions/Deploy-Management-Alerts.json')) string(loadJsonContent('../policySetDefinitions/Deploy-ServiceHealth-Alerts.json')) string(loadJsonContent('../policySetDefinitions/Deploy-Notification-Assets.json')) - string(loadJsonContent('../policySetDefinitions/Deploy-HybridVM-Alerts.json')) ] AzureCloud: [] AzureChinaCloud: [] diff --git a/patterns/alz/templates/policySets.bicep b/patterns/alz/templates/policySets.bicep new file mode 100644 index 000000000..f6d5f3b88 --- /dev/null +++ b/patterns/alz/templates/policySets.bicep @@ -0,0 +1,171 @@ +targetScope = 'managementGroup' + +@metadata({ message: 'The JSON version of this file is programatically generated from Bicep. PLEASE DO NOT UPDATE MANUALLY!!' }) +@description('Provide a prefix (unique at tenant-scope) for the Management Group hierarchy and other resources created as part of an Azure landing zone. DEFAULT VALUE = "alz"') +param topLevelManagementGroupPrefix string = 'alz' + +@description('Optionally set the deployment location for policies with Deploy If Not Exists effect. DEFAULT VALUE = "deployment().location"') +param location string = deployment().location + +@description('Optionally set the scope for custom Policy Definitions used in Policy Set Definitions (Initiatives). Must be one of \'/\', \'/subscriptions/id\' or \'/providers/Microsoft.Management/managementGroups/id\'. DEFAULT VALUE = \'/providers/Microsoft.Management/managementGroups/\${topLevelManagementGroupPrefix}\'') +param scope string = tenantResourceId('Microsoft.Management/managementGroups', topLevelManagementGroupPrefix) + +// Extract the environment name to dynamically determine which policies to deploy. +var cloudEnv = environment().name + +// Default deployment locations used in templates +var defaultDeploymentLocationByCloudType = { + AzureCloud: 'northeurope' + AzureChinaCloud: 'chinaeast2' + AzureUSGovernment: 'usgovvirginia' +} + +// Used to identify template variables used in the templates for replacement. +var templateVars = { + scope: '/providers/Microsoft.Management/managementGroups/contoso' + defaultDeploymentLocation: '"location": "northeurope"' + localizedDeploymentLocation: '"location": "${defaultDeploymentLocationByCloudType[cloudEnv]}"' +} + +var targetDeploymentLocationByCloudType = { + AzureCloud: location ?? 'northeurope' + AzureChinaCloud: location ?? 'chinaeast2' + AzureUSGovernment: location ?? 'usgovvirginia' +} + +var deploymentLocation = '"location": "${targetDeploymentLocationByCloudType[cloudEnv]}"' + +// Unable to do the following commented out approach due to the error "The value must be a compile-time constant.bicep(BCP032)" +// See: https://github.com/Azure/bicep/issues/3816#issuecomment-1191230215 + +// The following vars are used to load the list of Policy Definitions to import +// var listPolicyDefinitionsAll = loadJsonContent('../data/policyDefinitions.All.json') +// var listPolicyDefinitionsAzureCloud = loadJsonContent('../data/policyDefinitions.AzureCloud.json') +// var listPolicyDefinitionsAzureChinaCloud = loadJsonContent('../data/policyDefinitions.AzureChinaCloud.json') +// var listPolicyDefinitionsAzureUSGovernment = loadJsonContent('../data/policyDefinitions.AzureUSGovernment.json') + +// The following vars are used to load the list of Policy Set Definitions to import +// var listPolicySetDefinitionsAll = loadJsonContent('../data/policySetDefinitions.All.json') +// var listPolicySetDefinitionsAzureCloud = loadJsonContent('../data/policySetDefinitions.AzureCloud.json') +// var listPolicySetDefinitionsAzureChinaCloud = loadJsonContent('../data/policySetDefinitions.AzureChinaCloud.json') +// var listPolicySetDefinitionsAzureUSGovernment = loadJsonContent('../data/policySetDefinitions.AzureUSGovernment.json') + +// The following vars are used to load the list of Policy Definitions to import +// var loadPolicyDefinitionsAll = [for item in listPolicyDefinitionsAll: loadTextContent(item)] +// var loadPolicyDefinitionsAzureCloud = [for item in listPolicyDefinitionsAzureCloud: loadTextContent(item)] +// var loadPolicyDefinitionsAzureChinaCloud = [for item in listPolicyDefinitionsAzureChinaCloud: loadTextContent(item)] +// var loadPolicyDefinitionsAzureUSGovernment = [for item in listPolicyDefinitionsAzureUSGovernment: loadTextContent(item)] + +// The following vars are used to load the list of Policy Set Definitions to import +// var loadPolicySetDefinitionsAll = [for item in listPolicySetDefinitionsAll: loadTextContent(item)] +// var loadPolicySetDefinitionsAzureCloud = [for item in listPolicySetDefinitionsAzureCloud: loadTextContent(item)] +// var loadPolicySetDefinitionsAzureChinaCloud = [for item in listPolicySetDefinitionsAzureChinaCloud: loadTextContent(item)] +// var loadPolicySetDefinitionsAzureUSGovernment = [for item in listPolicySetDefinitionsAzureUSGovernment: loadTextContent(item)] + +// The following var contains lists of files containing Policy Definition resources to load, grouped by compatibility with Cloud. +// To get a full list of Azure clouds, use the az cli command "az cloud list --output table" +// We use loadTextContent instead of loadJsonContent as this allows us to perform string replacement operations against the imported templates. +var loadPolicyDefinitions = { + All: [] + AzureCloud: [] + AzureChinaCloud: [] + AzureUSGovernment: [] +} + +// The following var contains lists of files containing Policy Set Definition (Initiative) resources to load, grouped by compatibility with Cloud. +// To get a full list of Azure clouds, use the az cli command "az cloud list --output table" +// We use loadTextContent instead of loadJsonContent as this allows us to perform string replacement operations against the imported templates. +// Use string(loadJsonContent('../file.json')) when the JSON has more than 131072 characters +var loadPolicySetDefinitions = { + All: [ + string(loadJsonContent('../policySetDefinitions/Deploy-LandingZone-Alerts.json')) + string(loadJsonContent('../policySetDefinitions/Deploy-Management-Alerts.json')) + ] + AzureCloud: [] + AzureChinaCloud: [] + AzureUSGovernment: [] +} + +// The following vars are used to manipulate the imported Policy Definitions to replace deployment location values +// Needs a double replace to handle updates in both templates for All clouds, and localized templates +var processPolicyDefinitionsAll = [for content in loadPolicyDefinitions.All: replace(replace(content, templateVars.defaultDeploymentLocation, deploymentLocation), templateVars.localizedDeploymentLocation, deploymentLocation)] +var processPolicyDefinitionsAzureCloud = [for content in loadPolicyDefinitions.AzureCloud: replace(replace(content, templateVars.defaultDeploymentLocation, deploymentLocation), templateVars.localizedDeploymentLocation, deploymentLocation)] +var processPolicyDefinitionsAzureChinaCloud = [for content in loadPolicyDefinitions.AzureChinaCloud: replace(replace(content, templateVars.defaultDeploymentLocation, deploymentLocation), templateVars.localizedDeploymentLocation, deploymentLocation)] +var processPolicyDefinitionsAzureUSGovernment = [for content in loadPolicyDefinitions.AzureUSGovernment: replace(replace(content, templateVars.defaultDeploymentLocation, deploymentLocation), templateVars.localizedDeploymentLocation, deploymentLocation)] + +// The following vars are used to manipulate the imported Policy Set Definitions to replace Policy Definition scope values +var processPolicySetDefinitionsAll = [for content in loadPolicySetDefinitions.All: replace(content, templateVars.scope, scope)] +var processPolicySetDefinitionsAzureCloud = [for content in loadPolicySetDefinitions.AzureCloud: replace(content, templateVars.scope, scope)] +var processPolicySetDefinitionsAzureChinaCloud = [for content in loadPolicySetDefinitions.AzureChinaCloud: replace(content, templateVars.scope, scope)] +var processPolicySetDefinitionsAzureUSGovernment = [for content in loadPolicySetDefinitions.AzureUSGovernment: replace(content, templateVars.scope, scope)] + +// The following vars are used to convert the imported Policy Definitions into objects from JSON +var policyDefinitionsAll = [for content in processPolicyDefinitionsAll: json(content)] +var policyDefinitionsAzureCloud = [for content in processPolicyDefinitionsAzureCloud: json(content)] +var policyDefinitionsAzureChinaCloud = [for content in processPolicyDefinitionsAzureChinaCloud: json(content)] +var policyDefinitionsAzureUSGovernment = [for content in processPolicyDefinitionsAzureUSGovernment: json(content)] + +// The following vars are used to convert the imported Policy Set Definitions into objects from JSON +var policySetDefinitionsAll = [for content in processPolicySetDefinitionsAll: json(content)] +var policySetDefinitionsAzureCloud = [for content in processPolicySetDefinitionsAzureCloud: json(content)] +var policySetDefinitionsAzureChinaCloud = [for content in processPolicySetDefinitionsAzureChinaCloud: json(content)] +var policySetDefinitionsAzureUSGovernment = [for content in processPolicySetDefinitionsAzureUSGovernment: json(content)] + +// The following var is used to compile the required Policy Definitions into a single object +var policyDefinitionsByCloudType = { + All: policyDefinitionsAll + AzureCloud: policyDefinitionsAzureCloud + AzureChinaCloud: policyDefinitionsAzureChinaCloud + AzureUSGovernment: policyDefinitionsAzureUSGovernment +} + +// The following var is used to compile the required Policy Definitions into a single object +var policySetDefinitionsByCloudType = { + All: policySetDefinitionsAll + AzureCloud: policySetDefinitionsAzureCloud + AzureChinaCloud: policySetDefinitionsAzureChinaCloud + AzureUSGovernment: policySetDefinitionsAzureUSGovernment +} + +// The following var is used to extract the Policy Definitions into a single list for deployment +// This will contain all policy definitions classified as available for All cloud environments, and those for the current cloud environment +var policyDefinitions = concat(policyDefinitionsByCloudType.All, policyDefinitionsByCloudType[cloudEnv]) + +// The following var is used to extract the Policy Set Definitions into a single list for deployment +// This will contain all policy set definitions classified as available for All cloud environments, and those for the current cloud environment +var policySetDefinitions = concat(policySetDefinitionsByCloudType.All, policySetDefinitionsByCloudType[cloudEnv]) + +// Create the Policy Definitions as needed for the target cloud environment +resource PolicyDefinitions 'Microsoft.Authorization/policyDefinitions@2020-09-01' = [for policy in policyDefinitions: { + name: policy.name + properties: { + description: policy.properties.description + displayName: policy.properties.displayName + metadata: policy.properties.metadata + mode: policy.properties.mode + parameters: policy.properties.parameters + policyType: policy.properties.policyType + policyRule: policy.properties.policyRule + } +}] + +// Create the Policy Definitions as needed for the target cloud environment +// Depends on Policy Definitons to ensure they exist before creating dependent Policy Set Definitions (Initiatives) +resource PolicySetDefinitions 'Microsoft.Authorization/policySetDefinitions@2020-09-01' = [for policy in policySetDefinitions: { + dependsOn: [ + PolicyDefinitions + ] + name: policy.name + properties: { + description: policy.properties.description + displayName: policy.properties.displayName + metadata: policy.properties.metadata + parameters: policy.properties.parameters + policyType: policy.properties.policyType + policyDefinitions: policy.properties.policyDefinitions + policyDefinitionGroups: policy.properties.policyDefinitionGroups + } +}] + +output policyDefinitionNames array = [for policy in policyDefinitions: policy.name] +output policySetDefinitionNames array = [for policy in policySetDefinitions: policy.name] diff --git a/patterns/alz/templates/userAssignedManagedIdentity.json b/patterns/alz/templates/userAssignedManagedIdentity.json index 4f9118187..5db469398 100644 --- a/patterns/alz/templates/userAssignedManagedIdentity.json +++ b/patterns/alz/templates/userAssignedManagedIdentity.json @@ -1,57 +1,57 @@ { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "1.0.0.0", - "parameters": { - "uamiName": { - "type": "string", - "defaultValue": "id-amba-prod-001", - "metadata": { - "description": "The name of the user assigned managed identity to be created for monitoring purpose." - } - }, - "uamiLocation": { - "type": "string", - "defaultValue": "northeurope", - "metadata": { - "description": "The location of the User Assigned Managed Identity." - } - }, - "uamiResourceGroupName": { - "type": "string", - "defaultValue": "rg-amba-prod-001", - "metadata": { - "description": "The name of the resource group where the user assigned managed identity will be created." - } - } + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "uamiName": { + "type": "string", + "defaultValue": "id-amba-prod-001", + "metadata": { + "description": "The name of the user assigned managed identity to be created for monitoring purpose." + } + }, + "uamiLocation": { + "type": "string", + "defaultValue": "northeurope", + "metadata": { + "description": "The location of the User Assigned Managed Identity." + } }, - "variables": {}, - "resources": [ - { - "type": "Microsoft.Resources/deployments", - "apiVersion": "2021-04-01", - "name": "[concat('amba-', parameters('uamiName'))]", - "properties": { - "mode": "Incremental", - "template": { - "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", - "contentVersion": "1.0.0.0", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.ManagedIdentity/userAssignedIdentities", - "apiVersion": "2018-11-30", - "name": "[parameters('uamiName')]", - "location": "[parameters('uamiLocation')]", - "tags": { - "_deployed_by_amba": true - } - } - ] - } - }, - "resourceGroup": "[parameters('uamiResourceGroupName')]" + "uamiResourceGroupName": { + "type": "string", + "defaultValue": "rg-amba-prod-001", + "metadata": { + "description": "The name of the resource group where the user assigned managed identity will be created." + } + } + }, + "variables": {}, + "resources": [ + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2021-04-01", + "name": "[concat('amba-', parameters('uamiName'))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.ManagedIdentity/userAssignedIdentities", + "apiVersion": "2018-11-30", + "name": "[parameters('uamiName')]", + "location": "[parameters('uamiLocation')]", + "tags": { + "_deployed_by_amba": "true" + } + } + ] } - ], - "outputs": {} + }, + "resourceGroup": "[parameters('uamiResourceGroupName')]" + } + ], + "outputs": {} } diff --git a/services/AlertsManagement/actionRules/Deploy-AlertProcessingRule-Deploy.json b/services/AlertsManagement/actionRules/Deploy-AlertProcessingRule-Deploy.json index d53461c72..3a5e42ef3 100644 --- a/services/AlertsManagement/actionRules/Deploy-AlertProcessingRule-Deploy.json +++ b/services/AlertsManagement/actionRules/Deploy-AlertProcessingRule-Deploy.json @@ -8,7 +8,7 @@ "displayName": "Deploy AMBA Notification Assets", "description": "Policy to deploy Action Group and Alert Processing Rule for all AMBA alerts", "metadata": { - "version": "1.2.0", + "version": "1.3.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -44,12 +44,12 @@ "defaultValue": "centralus" }, "ALZMonitorActionGroupEmail": { - "type": "String", + "type": "Array", "metadata": { "displayName": "Action Group Email Addresses", "description": "Email addresses to send alerts to" }, - "defaultValue": "" + "defaultValue": [] }, "ALZLogicappResourceId": { "type": "String", @@ -68,28 +68,28 @@ "defaultValue": "" }, "ALZArmRoleId": { - "type": "String", + "type": "array", "metadata": { - "displayName": "Arm Role Id", - "description": "Arm Built-in Role Id for action group to send alerts to a subscription level, will only send to individual members of role" + "displayName": "Arm Role Ids", + "description": "Arm Built-in Role Ids for action group to send alerts to" }, - "defaultValue": "" + "defaultValue": [] }, "ALZEventHubResourceId": { - "type": "String", + "type": "array", "metadata": { - "displayName": "Event Hub resource id", - "description": "Event Hub resource id for action group to send alerts to" + "displayName": "Event Hub resource Ids", + "description": "Event Hub resource Ids for action group to send alerts to" }, - "defaultValue": "" + "defaultValue": [] }, "ALZWebhookServiceUri": { - "type": "String", + "type": "Array", "metadata": { - "displayName": "Webhook Service Uri", - "description": "Indicates the service uri of the webhook to send alerts to" + "displayName": "Webhook Service Uri(s)", + "description": "Indicates the service uri(s) of the webhook to send alerts to" }, - "defaultValue": "" + "defaultValue": [] }, "ALZFunctionResourceId": { "type": "String", @@ -108,12 +108,12 @@ "defaultValue": "" }, "BYOActionGroup": { - "type": "String", + "type": "array", "metadata": { - "displayName": "Customer defined Action Group Resource ID", - "description": "The Resource ID of an existing Action Group already deployed by the customer in his environment" + "displayName": "Customer defined Action Group Resource IDs", + "description": "The Resource IDs of existing Action Groups currently deployed in the environment." }, - "defaultValue": "" + "defaultValue": [] }, "BYOAlertProcessingRule": { "type": "String", @@ -123,13 +123,26 @@ }, "defaultValue": "" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Monitoring disabled", + "displayName": "ALZ Monitoring disabled tag name", "description": "Tag name to disable monitoring. Set to true if monitoring should be disabled" }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -140,8 +153,8 @@ "equals": "Microsoft.Resources/subscriptions" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" }, { "value": "[[empty(parameters('BYOAlertProcessingRule'))]", @@ -185,7 +198,7 @@ "type": "string" }, "ALZMonitorActionGroupEmail": { - "type": "string" + "type": "Array" }, "ALZLogicappResourceId": { "type": "string" @@ -194,13 +207,13 @@ "type": "String" }, "ALZArmRoleId": { - "type": "string" + "type": "array" }, "ALZEventHubResourceId": { - "type": "string" + "type": "array" }, "ALZWebhookServiceUri": { - "type": "string" + "type": "Array" }, "ALZFunctionResourceId": { "type": "string" @@ -209,19 +222,14 @@ "type": "String" }, "BYOActionGroup": { - "type": "String" + "type": "array" }, "BYOAlertProcessingRule": { "type": "String" } }, "variables": { - "varBYOAGs": "[[split(parameters('BYOActionGroup'), ',')]", "varBYOAlertProcessingRule": "[[if(empty(parameters('BYOAlertProcessingRule')), null(), trim(parameters('BYOAlertProcessingRule')))]", - "varALZMonitorActionGroupEmail": "[[array(split(parameters('ALZMonitorActionGroupEmail'),','))]", - "varALZArmRoleId": "[[array(split(parameters('ALZArmRoleId'),','))]", - "varALZEventHubResourceId": "[[array(split(parameters('ALZEventHubResourceId'),','))]", - "varALZWebhookServiceUri": "[[array(split(parameters('ALZWebhookServiceUri'),','))]", "varLogicAppReceivers": [ { "name": "AlzLA-0", @@ -242,46 +250,46 @@ "copy": [ { "name": "varEmailReceivers", - "count": "[[length(variables('varALZMonitorActionGroupEmail'))]", + "count": "[[length(parameters('ALZMonitorActionGroupEmail'))]", "mode": "serial", "input": { - "name": "[[concat('AlzMail-', indexOf(variables('varALZMonitorActionGroupEmail'), variables('varALZMonitorActionGroupEmail')[copyIndex('varEmailReceivers')]))]", - "emailAddress": "[[trim(variables('varALZMonitorActionGroupEmail')[copyIndex('varEmailReceivers')])]", + "name": "[[concat('AlzMail-', indexOf(parameters('ALZMonitorActionGroupEmail'), parameters('ALZMonitorActionGroupEmail')[copyIndex('varEmailReceivers')]))]", + "emailAddress": "[[trim(parameters('ALZMonitorActionGroupEmail')[copyIndex('varEmailReceivers')])]", "useCommonSchema": true } }, { "name": "varArmRoleReceivers", - "count": "[[length(variables('varALZArmRoleId'))]", + "count": "[[length(parameters('ALZArmRoleId'))]", "mode": "serial", "input": { - "name": "[[concat('AlzARM-', indexOf(variables('varALZArmRoleId'), variables('varALZArmRoleId')[copyIndex('varArmRoleReceivers')]))]", - "roleId": "[[trim(variables('varALZArmRoleId')[copyIndex('varArmRoleReceivers')])]", + "name": "[[concat('AlzARM-', indexOf(parameters('ALZArmRoleId'), parameters('ALZArmRoleId')[copyIndex('varArmRoleReceivers')]))]", + "roleId": "[[trim(parameters('ALZArmRoleId')[copyIndex('varArmRoleReceivers')])]", "useCommonSchema": true } }, { "name": "varEventHubReceivers", - "count": "[[length(variables('varALZEventHubResourceId'))]", + "count": "[[length(parameters('ALZEventHubResourceId'))]", "mode": "serial", "input": { - "name": "[[concat('AlzEH-', indexOf(variables('varALZEventHubResourceId'), variables('varALZEventHubResourceId')[copyIndex('varEventHubReceivers')]))]", - "subscriptionId": "[[if(empty(parameters('ALZEventHubResourceId')), null(), split(trim(variables('varALZEventHubResourceId')[copyIndex('varEventHubReceivers')]),'/')[2])]", - "eventHubNameSpace": "[[if(empty(parameters('ALZEventHubResourceId')), null(), split(trim(variables('varALZEventHubResourceId')[copyIndex('varEventHubReceivers')]),'/')[8])]", - "eventHubName": "[[if(empty(parameters('ALZEventHubResourceId')), null(), split(trim(variables('varALZEventHubResourceId')[copyIndex('varEventHubReceivers')]),'/')[10])]", + "name": "[[concat('AlzEH-', indexOf(parameters('ALZEventHubResourceId'), parameters('ALZEventHubResourceId')[copyIndex('varEventHubReceivers')]))]", + "subscriptionId": "[[if(empty(parameters('ALZEventHubResourceId')), null(), split(trim(parameters('ALZEventHubResourceId')[copyIndex('varEventHubReceivers')]),'/')[2])]", + "eventHubNameSpace": "[[if(empty(parameters('ALZEventHubResourceId')), null(), split(trim(parameters('ALZEventHubResourceId')[copyIndex('varEventHubReceivers')]),'/')[8])]", + "eventHubName": "[[if(empty(parameters('ALZEventHubResourceId')), null(), split(trim(parameters('ALZEventHubResourceId')[copyIndex('varEventHubReceivers')]),'/')[10])]", "useCommonAlertSchema": true, "tenantId": "[[subscription().tenantId]" } }, { "name": "varWebhookReceivers", - "count": "[[length(variables('varALZWebhookServiceUri'))]", + "count": "[[length(parameters('ALZWebhookServiceUri'))]", "mode": "serial", "input": { - "name": "[[concat('AlzWh-', indexOf(variables('varALZWebhookServiceUri'), variables('varALZWebhookServiceUri')[copyIndex('varWebhookReceivers')]))]", + "name": "[[concat('AlzWh-', indexOf(parameters('ALZWebhookServiceUri'), parameters('ALZWebhookServiceUri')[copyIndex('varWebhookReceivers')]))]", "identifierUri": "null()", "objectId": "null()", - "serviceUri": "[[trim(variables('varALZWebhookServiceUri')[copyIndex('varWebhookReceivers')])]", + "serviceUri": "[[trim(parameters('ALZWebhookServiceUri')[copyIndex('varWebhookReceivers')])]", "useCommonAlertSchema": true, "tenantId": "null()", "useAadAuth": "false" @@ -289,9 +297,9 @@ }, { "name": "varAGIds", - "count": "[[length(variables('varBYOAGs'))]", + "count": "[[length(parameters('BYOActionGroup'))]", "mode": "serial", - "input": "[[trim(variables('varBYOAGs')[copyIndex('varAGIds')])]" + "input": "[[trim(parameters('BYOActionGroup')[copyIndex('varAGIds')])]" } ] }, @@ -321,7 +329,7 @@ "type": "string" }, "ALZMonitorActionGroupEmail": { - "type": "string" + "type": "Array" }, "ALZLogicappResourceId": { "type": "string" @@ -330,13 +338,13 @@ "type": "string" }, "ALZArmRoleId": { - "type": "string" + "type": "array" }, "ALZEventHubResourceId": { - "type": "string" + "type": "array" }, "ALZWebhookServiceUri": { - "type": "string" + "type": "Array" }, "ALZFunctionResourceId": { "type": "string" @@ -345,7 +353,7 @@ "type": "string" }, "BYOActionGroup": { - "type": "string" + "type": "array" }, "BYOAlertProcessingRule": { "type": "string" diff --git a/services/AlertsManagement/actionRules/Deploy-AlertProcessingRule-Suppression.json b/services/AlertsManagement/actionRules/Deploy-AlertProcessingRule-Suppression.json index 742a09309..a9be7976d 100644 --- a/services/AlertsManagement/actionRules/Deploy-AlertProcessingRule-Suppression.json +++ b/services/AlertsManagement/actionRules/Deploy-AlertProcessingRule-Suppression.json @@ -8,7 +8,7 @@ "displayName": "Deploy AMBA Notification Suppression Asset", "description": "Policy to deploy empty and disabled suppression Alert Processing Rule for all AMBA alerts", "metadata": { - "version": "1.0.0", + "version": "1.1.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -43,13 +43,26 @@ }, "defaultValue": "centralus" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Monitoring disabled", - "description": "Tag name to disable monitoring. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -60,8 +73,8 @@ "equals": "Microsoft.Resources/subscriptions" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -101,8 +114,7 @@ "type": "string" } }, - "variables": { - }, + "variables": {}, "resources": [ { "type": "Microsoft.Resources/resourceGroups", @@ -136,8 +148,7 @@ "apiVersion": "2021-08-08", "name": "[[concat('apr-AMBA-',subscription().displayName, '-002')]", "location": "Global", - "dependsOn": [ - ], + "dependsOn": [], "tags": { "_deployed_by_amba": true }, diff --git a/services/Automation/automationAccounts/Deploy-AA-TotalJob-Alert.json b/services/Automation/automationAccounts/Deploy-AA-TotalJob-Alert.json index 482106042..6e4fcbe97 100644 --- a/services/Automation/automationAccounts/Deploy-AA-TotalJob-Alert.json +++ b/services/Automation/automationAccounts/Deploy-AA-TotalJob-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy Automation Account TotalJob Alert", "description": "Policy to audit/deploy Automation Account TotalJob Alert", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Automation", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -109,13 +109,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring on resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name to disable monitoring. Set to true if monitoring should be disabled" }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -126,8 +139,8 @@ "equals": "Microsoft.Automation/automationAccounts" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -182,7 +195,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-TotalJob-threshold-override_'), field('tags._amba-TotalJob-threshold-override_'), parameters('threshold'))]" } ] }, @@ -316,7 +329,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-TotalJob-threshold-override_'), field('tags._amba-TotalJob-threshold-override_'), parameters('threshold'))]" } } } diff --git a/services/Cdn/profiles/Deploy-CDNP-OriginHealthPercentage-Alert.json b/services/Cdn/profiles/Deploy-CDNP-OriginHealthPercentage-Alert.json index 7dbb1410f..de577ae42 100644 --- a/services/Cdn/profiles/Deploy-CDNP-OriginHealthPercentage-Alert.json +++ b/services/Cdn/profiles/Deploy-CDNP-OriginHealthPercentage-Alert.json @@ -8,8 +8,8 @@ "displayName": "Deploy FrontDoor CDN Profile Origin Health Percentage Alert", "description": "Policy to audit/deploy FrontDoor Origin Health Percentage Alert", "metadata": { - "version": "1.1.1", - "category": "Networking", + "version": "1.2.0", + "Category": "Networking", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "_deployed_by_amba": "True" }, @@ -106,13 +106,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -123,8 +136,8 @@ "equals": "Microsoft.Cdn/profiles" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -179,7 +192,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-OriginHealthPercentage-threshold-override_'), field('tags._amba-OriginHealthPercentage-threshold-override_'), parameters('threshold'))]" } ] }, @@ -304,7 +317,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-OriginHealthPercentage-threshold-override_'), field('tags._amba-OriginHealthPercentage-threshold-override_'), parameters('threshold'))]" } } } diff --git a/services/Cdn/profiles/Deploy-CDNP-OriginLatency-Alert.json b/services/Cdn/profiles/Deploy-CDNP-OriginLatency-Alert.json index 6cdfe2e8d..45d503afe 100644 --- a/services/Cdn/profiles/Deploy-CDNP-OriginLatency-Alert.json +++ b/services/Cdn/profiles/Deploy-CDNP-OriginLatency-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy FrontDoor CDN Profile Origin Latency Alert", "description": "Policy to audit/deploy FrontDoor CDN Profile Origin Latency Alert", "metadata": { - "version": "1.1.1", + "version": "1.2.0", "category": "Networking", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -101,13 +101,26 @@ ], "defaultValue": "disabled" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -118,8 +131,8 @@ "equals": "Microsoft.Cdn/profiles" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, diff --git a/services/Cdn/profiles/Deploy-CDNP-Percentage4XX-Alert.json b/services/Cdn/profiles/Deploy-CDNP-Percentage4XX-Alert.json index 6dc5da259..943984c85 100644 --- a/services/Cdn/profiles/Deploy-CDNP-Percentage4XX-Alert.json +++ b/services/Cdn/profiles/Deploy-CDNP-Percentage4XX-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy FrontDoor CDN Profile Percentage4XX Alert", "description": "Policy to audit/deploy FrontDoor CDN Profile Percentage4XX Alert", "metadata": { - "version": "1.1.1", + "version": "1.2.0", "category": "Networking", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -101,13 +101,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -118,8 +131,8 @@ "equals": "Microsoft.Cdn/profiles" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, diff --git a/services/Cdn/profiles/Deploy-CDNP-Percentage5XX-Alert.json b/services/Cdn/profiles/Deploy-CDNP-Percentage5XX-Alert.json index 4a940ab7d..3bd9a6138 100644 --- a/services/Cdn/profiles/Deploy-CDNP-Percentage5XX-Alert.json +++ b/services/Cdn/profiles/Deploy-CDNP-Percentage5XX-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy FrontDoor CDN Profile Percentage5XX Alert", "description": "Policy to audit/deploy FrontDoor CDN Profile Percentage5XX Alert", "metadata": { - "version": "1.1.1", + "version": "1.2.0", "category": "Networking", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -101,13 +101,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -118,8 +131,8 @@ "equals": "Microsoft.Cdn/profiles" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, diff --git a/services/Compute/virtualMachines/Deploy-VM-AvailableMemory-Alert.json b/services/Compute/virtualMachines/Deploy-VM-AvailableMemory-Alert.json index 21df95787..06abae07f 100644 --- a/services/Compute/virtualMachines/Deploy-VM-AvailableMemory-Alert.json +++ b/services/Compute/virtualMachines/Deploy-VM-AvailableMemory-Alert.json @@ -109,13 +109,26 @@ ], "defaultValue": "disabled" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name to disable monitoring. Set to true if monitoring should be disabled" }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -126,8 +139,8 @@ "equals": "Microsoft.Compute/virtualMachines" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -182,7 +195,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-AvailableMemoryBytes-threshold-override_'), field('tags._amba-AvailableMemoryBytes-threshold-override_'), parameters('threshold'))]" } ] }, @@ -307,7 +320,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-AvailableMemoryBytes-threshold-override_'), field('tags._amba-AvailableMemoryBytes-threshold-override_'), parameters('threshold'))]" } } } diff --git a/services/Compute/virtualMachines/Deploy-VM-DataDiskReadLatency-Alert.json b/services/Compute/virtualMachines/Deploy-VM-DataDiskReadLatency-Alert.json index 4f31b9c8f..6e8dbeec3 100644 --- a/services/Compute/virtualMachines/Deploy-VM-DataDiskReadLatency-Alert.json +++ b/services/Compute/virtualMachines/Deploy-VM-DataDiskReadLatency-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy VM Data Disk Read Latency Alert", "description": "Policy to audit/deploy VM dataDiskReadLatency Alert", "metadata": { - "version": "1.2.0", + "version": "1.4.0", "category": "Compute", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -23,7 +23,7 @@ "displayName": "Resource Group Name", "description": "Resource group the alert is placed in" }, - "defaultValue": "AlzMonitoring-rg" + "defaultValue": "rg-amba-monitoring-001" }, "alertResourceGroupTags": { "type": "Object", @@ -32,7 +32,7 @@ "description": "Tags on the Resource group the alert is placed in" }, "defaultValue": { - "environment": "test" + "Project": "amba-monitoring" } }, "alertResourceGroupLocation": { @@ -43,6 +43,14 @@ }, "defaultValue": "centralus" }, + "UAMIResourceId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "The resource Id of the user assigned managed identity.", + "displayName": "User Assigned managed Identity resource Id." + } + }, "severity": { "type": "String", "metadata": { @@ -64,11 +72,7 @@ "displayName": "Operator" }, "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" + "GreaterThan" ], "defaultValue": "GreaterThan" }, @@ -78,13 +82,9 @@ "displayName": "TimeAggregation" }, "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" + "Count" ], - "defaultValue": "Average" + "defaultValue": "Count" }, "windowSize": { "type": "String", @@ -195,16 +195,6 @@ "*" ] }, - "disksToInclude": { - "type": "array", - "metadata": { - "displayName": "Disks to be included to be monitored", - "description": "Array of disk to be monitored for disk both windows and linux" - }, - "defaultValue": [ - "*" - ] - }, "effect": { "type": "String", "metadata": { @@ -216,6 +206,27 @@ "disabled" ], "defaultValue": "deployIfNotExists" + }, + "MonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name to disable monitoring. Set to true if monitoring should be disabled" + }, + "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -224,6 +235,10 @@ { "field": "type", "equals": "Microsoft.Compute/virtualMachines" + }, + { + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -234,43 +249,39 @@ "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c" ], "type": "Microsoft.Insights/scheduledQueryRules", - "existenceScope": "resourcegroup", + "existenceScope": "resourceGroup", "resourceGroupName": "[[parameters('alertResourceGroupName')]", "deploymentScope": "subscription", "existenceCondition": { "allOf": [ { "field": "Microsoft.Insights/scheduledQueryRules/displayName", - "equals": "[[concat(subscription().displayName, '-VMHighdataDiskReadLatencyAlert')]" + "equals": "[[concat(subscription().displayName, '-VMHighDataDiskReadLatencyAlert')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/scopes[*]", + "field": "Microsoft.Insights/scheduledQueryRules/scopes[*]", "equals": "[[subscription().id]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/enabled", + "field": "Microsoft.Insights/scheduledQueryRules/enabled", "equals": "[[parameters('enabled')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/evaluationFrequency", + "field": "Microsoft.Insights/scheduledQueryRules/evaluationFrequency", "equals": "[[parameters('evaluationFrequency')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/windowSize", + "field": "Microsoft.Insights/scheduledQueryRules/windowSize", "equals": "[[parameters('windowSize')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/severity", + "field": "Microsoft.Insights/scheduledQueryRules/severity", "equals": "[[parameters('severity')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/autoMitigate", + "field": "Microsoft.Insights/scheduledQueryRules/autoMitigate", "equals": "[[parameters('autoMitigate')]" }, - { - "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold", - "equals": "[[parameters('threshold')]" - }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator", "equals": "[[parameters('operator')]" @@ -289,7 +300,11 @@ }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query", - "equals": "InsightsMetrics| where Origin == \"vm.azm.ms\"| where Namespace == \"LogicalDisk\" and Name == \"ReadLatencyMs\"| extend Disk=tostring(todynamic(Tags)[\"vm.azm.ms/mountId\"])|where Disk !in ('C:','/')| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk" + "equals": "[[format('let policyThresholdString = \"{2}\"; let excludedResources = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\"{1}\")); let excludedVMSSNodes = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | project _ResourceId = tolower(id), tags | where tags contains \"_amba-ReadLatencyMs-Data-threshold-override_\"); InsightsMetrics | where _ResourceId has \"Microsoft.Compute/virtualMachines\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \"vm.azm.ms\" | where Namespace == \"LogicalDisk\" and Name == \"ReadLatencyMs\" | extend Disk=tostring(todynamic(Tags)[\"vm.azm.ms/mountId\"]) | where Disk !in (\"C:\", \"/\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \"_amba-ReadLatencyMs-Data-threshold-override_\", tostring(tags.[\"_amba-ReadLatencyMs-Data-threshold-override_\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'), parameters('threshold'))]" + }, + { + "field": "identity.userAssignedIdentities", + "containsKey": "[[parameters('UAMIResourceId')]" } ] }, @@ -310,6 +325,9 @@ "alertResourceGroupLocation": { "type": "string" }, + "UAMIResourceId": { + "type": "string" + }, "severity": { "type": "String" }, @@ -346,11 +364,14 @@ "evaluationPeriods": { "type": "String" }, - "disksToInclude": { - "type": "array" - }, "computersToInclude": { "type": "array" + }, + "MonitorDisableTagName": { + "type": "String" + }, + "MonitorDisableTagValues": { + "type": "Array" } }, "variables": {}, @@ -384,6 +405,9 @@ }, "alertResourceGroupLocation": { "type": "string" + }, + "UAMIResourceId": { + "type": "string" } }, "variables": {}, @@ -391,13 +415,19 @@ { "type": "Microsoft.Insights/scheduledQueryRules", "apiVersion": "2022-08-01-preview", - "name": "[[concat(subscription().displayName, '-VMHighdataDiskReadLatencyAlert')]", + "name": "[[concat(subscription().displayName, '-VMHighDataDiskReadLatencyAlert')]", "location": "[[parameters('alertResourceGroupLocation')]", + "identity": { + "type": "UserAssigned", + "userAssignedIdentities": { + "[[parameters('UAMIResourceId')]": {} + } + }, "tags": { "_deployed_by_amba": true }, "properties": { - "displayName": "[[concat(subscription().displayName, '-VMHighdataDiskReadLatencyAlert')]", + "displayName": "[[concat(subscription().displayName, '-VMHighDataDiskReadLatencyAlert')]", "description": "Log Alert for Virtual Machine dataDiskReadLatency", "severity": "[[parameters('severity')]", "enabled": "[[parameters('enabled')]", @@ -412,9 +442,8 @@ "criteria": { "allOf": [ { - "query": "InsightsMetrics| where Origin == \"vm.azm.ms\"| where Namespace == \"LogicalDisk\" and Name == \"ReadLatencyMs\"| extend Disk=tostring(todynamic(Tags)[\"vm.azm.ms/mountId\"])|where Disk !in ('C:','/')| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk", - "metricMeasureColumn": "AggregatedValue", - "threshold": "[[parameters('threshold')]", + "query": "[[format('let policyThresholdString = \"{2}\"; let excludedResources = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\"{1}\")); let excludedVMSSNodes = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | project _ResourceId = tolower(id), tags | where tags contains \"_amba-ReadLatencyMs-Data-threshold-override_\"); InsightsMetrics | where _ResourceId has \"Microsoft.Compute/virtualMachines\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \"vm.azm.ms\" | where Namespace == \"LogicalDisk\" and Name == \"ReadLatencyMs\" | extend Disk=tostring(todynamic(Tags)[\"vm.azm.ms/mountId\"]) | where Disk !in (\"C:\", \"/\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \"_amba-ReadLatencyMs-Data-threshold-override_\", tostring(tags.[\"_amba-ReadLatencyMs-Data-threshold-override_\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'), parameters('threshold'))]", + "threshold": 0, "operator": "[[parameters('operator')]", "resourceIdColumn": "_ResourceId", "timeAggregation": "[[parameters('timeAggregation')]", @@ -427,7 +456,9 @@ { "name": "Disk", "operator": "Include", - "values": "[[parameters('disksToInclude')]" + "values": [ + "*" + ] } ], "failingPeriods": { @@ -449,6 +480,9 @@ "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" + }, "severity": { "value": "[[parameters('severity')]" }, @@ -479,11 +513,14 @@ "evaluationPeriods": { "value": "[[parameters('evaluationPeriods')]" }, - "disksToInclude": { - "value": "[[parameters('disksToInclude')]" - }, "computersToInclude": { "value": "[[parameters('computersToInclude')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('MonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('MonitorDisableTagValues')]" } } } @@ -499,6 +536,9 @@ }, "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" + }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" } } } @@ -515,6 +555,9 @@ "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" + }, "severity": { "value": "[[parameters('severity')]" }, @@ -551,11 +594,14 @@ "evaluationPeriods": { "value": "[[parameters('evaluationPeriods')]" }, - "disksToInclude": { - "value": "[[parameters('disksToInclude')]" - }, "computersToInclude": { "value": "[[parameters('computersToInclude')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('MonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('MonitorDisableTagValues')]" } } } diff --git a/services/Compute/virtualMachines/Deploy-VM-DataDiskSpace-Alert.json b/services/Compute/virtualMachines/Deploy-VM-DataDiskSpace-Alert.json index edf5e7fd7..32d3c6883 100644 --- a/services/Compute/virtualMachines/Deploy-VM-DataDiskSpace-Alert.json +++ b/services/Compute/virtualMachines/Deploy-VM-DataDiskSpace-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy VM Data Disk Space Alert", "description": "Policy to audit/deploy VM data Disk Space Alert", "metadata": { - "version": "1.2.0", + "version": "1.4.0", "category": "Compute", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -23,7 +23,7 @@ "displayName": "Resource Group Name", "description": "Resource group the alert is placed in" }, - "defaultValue": "AlzMonitoring-rg" + "defaultValue": "rg-amba-monitoring-001" }, "alertResourceGroupTags": { "type": "Object", @@ -32,7 +32,7 @@ "description": "Tags on the Resource group the alert is placed in" }, "defaultValue": { - "environment": "test" + "Project": "amba-monitoring" } }, "alertResourceGroupLocation": { @@ -43,6 +43,14 @@ }, "defaultValue": "centralus" }, + "UAMIResourceId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "The resource Id of the user assigned managed identity.", + "displayName": "User Assigned managed Identity resource Id." + } + }, "severity": { "type": "String", "metadata": { @@ -64,13 +72,9 @@ "displayName": "Operator" }, "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" + "GreaterThan" ], - "defaultValue": "LessThan" + "defaultValue": "GreaterThan" }, "timeAggregation": { "type": "String", @@ -78,13 +82,9 @@ "displayName": "TimeAggregation" }, "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" + "Count" ], - "defaultValue": "Average" + "defaultValue": "Count" }, "windowSize": { "type": "String", @@ -185,6 +185,16 @@ }, "defaultValue": "1" }, + "computersToInclude": { + "type": "array", + "metadata": { + "displayName": "Computers to be included to be monitored", + "description": "Array of Computer to be monitored" + }, + "defaultValue": [ + "*" + ] + }, "effect": { "type": "String", "metadata": { @@ -197,14 +207,25 @@ ], "defaultValue": "deployIfNotExists" }, - "disksToInclude": { - "type": "array", + "MonitorDisableTagName": { + "type": "String", "metadata": { - "displayName": "Disks to be included to be monitored", - "description": "Array of disk to be monitored for disk both Windows and Linux" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name to disable monitoring. Set to true if monitoring should be disabled" + }, + "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": [ - "*" + "true", + "Test", + "Dev", + "Sandbox" ] } }, @@ -214,6 +235,10 @@ { "field": "type", "equals": "Microsoft.Compute/virtualMachines" + }, + { + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -224,43 +249,39 @@ "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c" ], "type": "Microsoft.Insights/scheduledQueryRules", - "existenceScope": "resourcegroup", + "existenceScope": "resourceGroup", "resourceGroupName": "[[parameters('alertResourceGroupName')]", "deploymentScope": "subscription", "existenceCondition": { "allOf": [ { "field": "Microsoft.Insights/scheduledQueryRules/displayName", - "equals": "[[concat(subscription().displayName, '-VMLowdataDiskSpaceAlert')]" + "equals": "[[concat(subscription().displayName, '-VMLowDataDiskSpaceAlert')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/scopes[*]", + "field": "Microsoft.Insights/scheduledQueryRules/scopes[*]", "equals": "[[subscription().id]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/enabled", + "field": "Microsoft.Insights/scheduledQueryRules/enabled", "equals": "[[parameters('enabled')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/evaluationFrequency", + "field": "Microsoft.Insights/scheduledQueryRules/evaluationFrequency", "equals": "[[parameters('evaluationFrequency')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/windowSize", + "field": "Microsoft.Insights/scheduledQueryRules/windowSize", "equals": "[[parameters('windowSize')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/severity", + "field": "Microsoft.Insights/scheduledQueryRules/severity", "equals": "[[parameters('severity')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/autoMitigate", + "field": "Microsoft.Insights/scheduledQueryRules/autoMitigate", "equals": "[[parameters('autoMitigate')]" }, - { - "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold", - "equals": "[[parameters('threshold')]" - }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator", "equals": "[[parameters('operator')]" @@ -279,7 +300,11 @@ }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query", - "equals": "InsightsMetrics| where Origin == \"vm.azm.ms\"| where Namespace == \"LogicalDisk\" and Name == \"FreeSpacePercentage\"| extend Disk=tostring(todynamic(Tags)[\"vm.azm.ms/mountId\"])|where Disk !in ('C:','/')| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk" + "equals": "[[format('let policyThresholdString = \"{2}\"; let excludedResources = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\"{1}\")); let excludedVMSSNodes = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | project _ResourceId = tolower(id), tags | where tags contains \"_amba-FreeSpacePercentage-Data-threshold-override_\"); InsightsMetrics | where _ResourceId has \"Microsoft.Compute/virtualMachines\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \"vm.azm.ms\" | where Namespace == \"LogicalDisk\" and Name == \"FreeSpacePercentage\" | extend Disk=tostring(todynamic(Tags)[\"vm.azm.ms/mountId\"]) | where Disk !in (\"C:\", \"/\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \"_amba-FreeSpacePercentage-Data-threshold-override_\", tostring(tags.[\"_amba-FreeSpacePercentage-Data-threshold-override_\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'), parameters('threshold'))]" + }, + { + "field": "identity.userAssignedIdentities", + "containsKey": "[[parameters('UAMIResourceId')]" } ] }, @@ -300,6 +325,9 @@ "alertResourceGroupLocation": { "type": "string" }, + "UAMIResourceId": { + "type": "string" + }, "severity": { "type": "String" }, @@ -336,8 +364,14 @@ "evaluationPeriods": { "type": "String" }, - "disksToInclude": { + "computersToInclude": { "type": "array" + }, + "MonitorDisableTagName": { + "type": "String" + }, + "MonitorDisableTagValues": { + "type": "Array" } }, "variables": {}, @@ -371,6 +405,9 @@ }, "alertResourceGroupLocation": { "type": "string" + }, + "UAMIResourceId": { + "type": "string" } }, "variables": {}, @@ -378,13 +415,19 @@ { "type": "Microsoft.Insights/scheduledQueryRules", "apiVersion": "2022-08-01-preview", - "name": "[[concat(subscription().displayName, '-VMLowdataDiskSpaceAlert')]", + "name": "[[concat(subscription().displayName, '-VMLowDataDiskSpaceAlert')]", "location": "[[parameters('alertResourceGroupLocation')]", + "identity": { + "type": "UserAssigned", + "userAssignedIdentities": { + "[[parameters('UAMIResourceId')]": {} + } + }, "tags": { "_deployed_by_amba": true }, "properties": { - "displayName": "[[concat(subscription().displayName, '-VMLowdataDiskSpaceAlert')]", + "displayName": "[[concat(subscription().displayName, '-VMLowDataDiskSpaceAlert')]", "description": "Log Alert for Virtual Machine dataDiskSpace", "severity": "[[parameters('severity')]", "enabled": "[[parameters('enabled')]", @@ -399,9 +442,8 @@ "criteria": { "allOf": [ { - "query": "InsightsMetrics| where Origin == \"vm.azm.ms\"| where Namespace == \"LogicalDisk\" and Name == \"FreeSpacePercentage\"| extend Disk=tostring(todynamic(Tags)[\"vm.azm.ms/mountId\"])|where Disk !in ('C:','/')| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk", - "metricMeasureColumn": "AggregatedValue", - "threshold": "[[parameters('threshold')]", + "query": "[[format('let policyThresholdString = \"{2}\"; let excludedResources = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\"{1}\")); let excludedVMSSNodes = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | project _ResourceId = tolower(id), tags | where tags contains \"_amba-FreeSpacePercentage-Data-threshold-override_\"); InsightsMetrics | where _ResourceId has \"Microsoft.Compute/virtualMachines\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \"vm.azm.ms\" | where Namespace == \"LogicalDisk\" and Name == \"FreeSpacePercentage\" | extend Disk=tostring(todynamic(Tags)[\"vm.azm.ms/mountId\"]) | where Disk !in (\"C:\", \"/\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \"_amba-FreeSpacePercentage-Data-threshold-override_\", tostring(tags.[\"_amba-FreeSpacePercentage-Data-threshold-override_\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'), parameters('threshold'))]", + "threshold": 0, "operator": "[[parameters('operator')]", "resourceIdColumn": "_ResourceId", "timeAggregation": "[[parameters('timeAggregation')]", @@ -409,14 +451,14 @@ { "name": "Computer", "operator": "Include", - "values": [ - "*" - ] + "values": "[[parameters('computersToInclude')]" }, { "name": "Disk", "operator": "Include", - "values": "[[parameters('disksToInclude')]" + "values": [ + "*" + ] } ], "failingPeriods": { @@ -438,6 +480,9 @@ "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" + }, "severity": { "value": "[[parameters('severity')]" }, @@ -468,8 +513,14 @@ "evaluationPeriods": { "value": "[[parameters('evaluationPeriods')]" }, - "disksToInclude": { - "value": "[[parameters('disksToInclude')]" + "computersToInclude": { + "value": "[[parameters('computersToInclude')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('MonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('MonitorDisableTagValues')]" } } } @@ -485,6 +536,9 @@ }, "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" + }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" } } } @@ -501,6 +555,9 @@ "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" + }, "severity": { "value": "[[parameters('severity')]" }, @@ -537,8 +594,14 @@ "evaluationPeriods": { "value": "[[parameters('evaluationPeriods')]" }, - "disksToInclude": { - "value": "[[parameters('disksToInclude')]" + "computersToInclude": { + "value": "[[parameters('computersToInclude')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('MonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('MonitorDisableTagValues')]" } } } diff --git a/services/Compute/virtualMachines/Deploy-VM-DataDiskWriteLatency-Alert.json b/services/Compute/virtualMachines/Deploy-VM-DataDiskWriteLatency-Alert.json index fab58e695..f8d39d3d3 100644 --- a/services/Compute/virtualMachines/Deploy-VM-DataDiskWriteLatency-Alert.json +++ b/services/Compute/virtualMachines/Deploy-VM-DataDiskWriteLatency-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy VM Data Disk Write Latency Alert", "description": "Policy to audit/deploy VM dataDiskWriteLatency Alert", "metadata": { - "version": "1.2.0", + "version": "1.4.0", "category": "Compute", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -23,7 +23,7 @@ "displayName": "Resource Group Name", "description": "Resource group the alert is placed in" }, - "defaultValue": "AlzMonitoring-rg" + "defaultValue": "rg-amba-monitoring-001" }, "alertResourceGroupTags": { "type": "Object", @@ -32,7 +32,7 @@ "description": "Tags on the Resource group the alert is placed in" }, "defaultValue": { - "environment": "test" + "Project": "amba-monitoring" } }, "alertResourceGroupLocation": { @@ -43,6 +43,14 @@ }, "defaultValue": "centralus" }, + "UAMIResourceId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "The resource Id of the user assigned managed identity.", + "displayName": "User Assigned managed Identity resource Id." + } + }, "severity": { "type": "String", "metadata": { @@ -64,11 +72,7 @@ "displayName": "Operator" }, "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" + "GreaterThan" ], "defaultValue": "GreaterThan" }, @@ -78,13 +82,9 @@ "displayName": "TimeAggregation" }, "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" + "Count" ], - "defaultValue": "Average" + "defaultValue": "Count" }, "windowSize": { "type": "String", @@ -195,16 +195,6 @@ "*" ] }, - "disksToInclude": { - "type": "array", - "metadata": { - "displayName": "Disks to be included to be monitored", - "description": "Array of disk to be monitored for disk both windows and linux" - }, - "defaultValue": [ - "*" - ] - }, "effect": { "type": "String", "metadata": { @@ -216,6 +206,27 @@ "disabled" ], "defaultValue": "deployIfNotExists" + }, + "MonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name to disable monitoring. Set to true if monitoring should be disabled" + }, + "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -224,6 +235,10 @@ { "field": "type", "equals": "Microsoft.Compute/virtualMachines" + }, + { + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -234,43 +249,39 @@ "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c" ], "type": "Microsoft.Insights/scheduledQueryRules", - "existenceScope": "resourcegroup", + "existenceScope": "resourceGroup", "resourceGroupName": "[[parameters('alertResourceGroupName')]", "deploymentScope": "subscription", "existenceCondition": { "allOf": [ { "field": "Microsoft.Insights/scheduledQueryRules/displayName", - "equals": "[[concat(subscription().displayName, '-VMHighdataDiskWriteLatencyAlert')]" + "equals": "[[concat(subscription().displayName, '-VMHighDataDiskWriteLatencyAlert')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/scopes[*]", + "field": "Microsoft.Insights/scheduledQueryRules/scopes[*]", "equals": "[[subscription().id]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/enabled", + "field": "Microsoft.Insights/scheduledQueryRules/enabled", "equals": "[[parameters('enabled')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/evaluationFrequency", + "field": "Microsoft.Insights/scheduledQueryRules/evaluationFrequency", "equals": "[[parameters('evaluationFrequency')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/windowSize", + "field": "Microsoft.Insights/scheduledQueryRules/windowSize", "equals": "[[parameters('windowSize')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/severity", + "field": "Microsoft.Insights/scheduledQueryRules/severity", "equals": "[[parameters('severity')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/autoMitigate", + "field": "Microsoft.Insights/scheduledQueryRules/autoMitigate", "equals": "[[parameters('autoMitigate')]" }, - { - "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold", - "equals": "[[parameters('threshold')]" - }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator", "equals": "[[parameters('operator')]" @@ -289,7 +300,11 @@ }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query", - "equals": "InsightsMetrics| where Origin == \"vm.azm.ms\"| where Namespace == \"LogicalDisk\" and Name == \"WriteLatencyMs\"| extend Disk=tostring(todynamic(Tags)[\"vm.azm.ms/mountId\"])|where Disk !in ('C:','/')| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk" + "equals": "[[format('let policyThresholdString = \"{2}\"; let excludedResources = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\"{1}\")); let excludedVMSSNodes = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | project _ResourceId = tolower(id), tags | where tags contains \"_amba-WriteLatencyMs-Data-threshold-override_\"); InsightsMetrics | where _ResourceId has \"Microsoft.Compute/virtualMachines\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \"vm.azm.ms\" | where Namespace == \"LogicalDisk\" and Name == \"WriteLatencyMs\" | extend Disk=tostring(todynamic(Tags)[\"vm.azm.ms/mountId\"]) | where Disk !in (\"C:\",\"/\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \"_amba-WriteLatencyMs-Data-threshold-override_\", tostring(tags.[\"_amba-WriteLatencyMs-Data-threshold-override_\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'), parameters('threshold'))]" + }, + { + "field": "identity.userAssignedIdentities", + "containsKey": "[[parameters('UAMIResourceId')]" } ] }, @@ -310,6 +325,9 @@ "alertResourceGroupLocation": { "type": "string" }, + "UAMIResourceId": { + "type": "string" + }, "severity": { "type": "String" }, @@ -346,11 +364,14 @@ "evaluationPeriods": { "type": "String" }, - "disksToInclude": { - "type": "array" - }, "computersToInclude": { "type": "array" + }, + "MonitorDisableTagName": { + "type": "String" + }, + "MonitorDisableTagValues": { + "type": "Array" } }, "variables": {}, @@ -384,6 +405,9 @@ }, "alertResourceGroupLocation": { "type": "string" + }, + "UAMIResourceId": { + "type": "string" } }, "variables": {}, @@ -391,13 +415,19 @@ { "type": "Microsoft.Insights/scheduledQueryRules", "apiVersion": "2022-08-01-preview", - "name": "[[concat(subscription().displayName, '-VMHighdataDiskWriteLatencyAlert')]", + "name": "[[concat(subscription().displayName, '-VMHighDataDiskWriteLatencyAlert')]", "location": "[[parameters('alertResourceGroupLocation')]", + "identity": { + "type": "UserAssigned", + "userAssignedIdentities": { + "[[parameters('UAMIResourceId')]": {} + } + }, "tags": { "_deployed_by_amba": true }, "properties": { - "displayName": "[[concat(subscription().displayName, '-VMHighdataDiskWriteLatencyAlert')]", + "displayName": "[[concat(subscription().displayName, '-VMHighDataDiskWriteLatencyAlert')]", "description": "Log Alert for Virtual Machine dataDiskWriteLatency", "severity": "[[parameters('severity')]", "enabled": "[[parameters('enabled')]", @@ -412,9 +442,8 @@ "criteria": { "allOf": [ { - "query": "InsightsMetrics| where Origin == \"vm.azm.ms\"| where Namespace == \"LogicalDisk\" and Name == \"WriteLatencyMs\"| extend Disk=tostring(todynamic(Tags)[\"vm.azm.ms/mountId\"])|where Disk !in ('C:','/')| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk", - "metricMeasureColumn": "AggregatedValue", - "threshold": "[[parameters('threshold')]", + "query": "[[format('let policyThresholdString = \"{2}\"; let excludedResources = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\"{1}\")); let excludedVMSSNodes = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | project _ResourceId = tolower(id), tags | where tags contains \"_amba-WriteLatencyMs-Data-threshold-override_\"); InsightsMetrics | where _ResourceId has \"Microsoft.Compute/virtualMachines\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \"vm.azm.ms\" | where Namespace == \"LogicalDisk\" and Name == \"WriteLatencyMs\" | extend Disk=tostring(todynamic(Tags)[\"vm.azm.ms/mountId\"]) | where Disk !in (\"C:\",\"/\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \"_amba-WriteLatencyMs-Data-threshold-override_\", tostring(tags.[\"_amba-WriteLatencyMs-Data-threshold-override_\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'), parameters('threshold'))]", + "threshold": 0, "operator": "[[parameters('operator')]", "resourceIdColumn": "_ResourceId", "timeAggregation": "[[parameters('timeAggregation')]", @@ -427,7 +456,9 @@ { "name": "Disk", "operator": "Include", - "values": "[[parameters('disksToInclude')]" + "values": [ + "*" + ] } ], "failingPeriods": { @@ -449,6 +480,9 @@ "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" + }, "severity": { "value": "[[parameters('severity')]" }, @@ -479,11 +513,14 @@ "evaluationPeriods": { "value": "[[parameters('evaluationPeriods')]" }, - "disksToInclude": { - "value": "[[parameters('disksToInclude')]" - }, "computersToInclude": { "value": "[[parameters('computersToInclude')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('MonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('MonitorDisableTagValues')]" } } } @@ -499,6 +536,9 @@ }, "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" + }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" } } } @@ -515,6 +555,9 @@ "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" + }, "severity": { "value": "[[parameters('severity')]" }, @@ -551,11 +594,14 @@ "evaluationPeriods": { "value": "[[parameters('evaluationPeriods')]" }, - "disksToInclude": { - "value": "[[parameters('disksToInclude')]" - }, "computersToInclude": { "value": "[[parameters('computersToInclude')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('MonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('MonitorDisableTagValues')]" } } } diff --git a/services/Compute/virtualMachines/Deploy-VM-HeartBeat-Alert.json b/services/Compute/virtualMachines/Deploy-VM-HeartBeat-Alert.json index 08da5a2b0..a80d41869 100644 --- a/services/Compute/virtualMachines/Deploy-VM-HeartBeat-Alert.json +++ b/services/Compute/virtualMachines/Deploy-VM-HeartBeat-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy VM HeartBeat Alert", "description": "Policy to audit/deploy VM HeartBeat Alert for all VMs in the subscription", "metadata": { - "version": "1.2.0", + "version": "1.4.0", "category": "Compute", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -23,7 +23,7 @@ "displayName": "Resource Group Name", "description": "Resource group the alert is placed in" }, - "defaultValue": "AlzMonitoring-rg" + "defaultValue": "rg-amba-monitoring-001" }, "alertResourceGroupTags": { "type": "Object", @@ -32,7 +32,7 @@ "description": "Tags on the Resource group the alert is placed in" }, "defaultValue": { - "environment": "test" + "Project": "amba-monitoring" } }, "alertResourceGroupLocation": { @@ -43,6 +43,14 @@ }, "defaultValue": "centralus" }, + "UAMIResourceId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "The resource Id of the user assigned managed identity.", + "displayName": "User Assigned managed Identity resource Id." + } + }, "severity": { "type": "String", "metadata": { @@ -64,11 +72,7 @@ "displayName": "Operator" }, "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" + "GreaterThan" ], "defaultValue": "GreaterThan" }, @@ -78,13 +82,9 @@ "displayName": "TimeAggregation" }, "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" + "Count" ], - "defaultValue": "Average" + "defaultValue": "Count" }, "windowSize": { "type": "String", @@ -101,7 +101,7 @@ "PT12H", "PT24H" ], - "defaultValue": "PT15M" + "defaultValue": "PT6H" }, "evaluationFrequency": { "type": "String", @@ -185,6 +185,16 @@ }, "defaultValue": "1" }, + "computersToInclude": { + "type": "array", + "metadata": { + "displayName": "Computers to be included to be monitored", + "description": "Array of Computer to be monitored" + }, + "defaultValue": [ + "*" + ] + }, "effect": { "type": "String", "metadata": { @@ -196,6 +206,27 @@ "disabled" ], "defaultValue": "deployIfNotExists" + }, + "MonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name to disable monitoring. Set to true if monitoring should be disabled" + }, + "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -204,6 +235,10 @@ { "field": "type", "equals": "Microsoft.Compute/virtualMachines" + }, + { + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -214,7 +249,7 @@ "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c" ], "type": "Microsoft.Insights/scheduledQueryRules", - "existenceScope": "resourcegroup", + "existenceScope": "resourceGroup", "resourceGroupName": "[[parameters('alertResourceGroupName')]", "deploymentScope": "subscription", "existenceCondition": { @@ -224,33 +259,29 @@ "equals": "[[concat(subscription().displayName, '-VMHeartBeatAlert')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/scopes[*]", + "field": "Microsoft.Insights/scheduledQueryRules/scopes[*]", "equals": "[[subscription().id]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/enabled", + "field": "Microsoft.Insights/scheduledQueryRules/enabled", "equals": "[[parameters('enabled')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/evaluationFrequency", + "field": "Microsoft.Insights/scheduledQueryRules/evaluationFrequency", "equals": "[[parameters('evaluationFrequency')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/windowSize", + "field": "Microsoft.Insights/scheduledQueryRules/windowSize", "equals": "[[parameters('windowSize')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/severity", + "field": "Microsoft.Insights/scheduledQueryRules/severity", "equals": "[[parameters('severity')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/autoMitigate", + "field": "Microsoft.Insights/scheduledQueryRules/autoMitigate", "equals": "[[parameters('autoMitigate')]" }, - { - "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold", - "equals": "[[parameters('threshold')]" - }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator", "equals": "[[parameters('operator')]" @@ -269,7 +300,11 @@ }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query", - "equals": "Heartbeat| summarize TimeGenerated=max(TimeGenerated) by Computer, _ResourceId| extend Duration = datetime_diff('minute',now(),TimeGenerated)| summarize AggregatedValue = min(Duration) by Computer, bin(TimeGenerated,5m), _ResourceId" + "equals": "[[format('let policyThresholdString = \"{2}\"; let excludedResources = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\"{1}\")); let excludedVMSSNodes = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | project _ResourceId = tolower(id), tags | where tags contains \"_amba-Heartbeat-threshold-override_\"); Heartbeat | where _ResourceId has \"Microsoft.Compute/virtualMachines\" | where _ResourceId !in~ (excludedResources) | summarize TimeGenerated=max(TimeGenerated) by Computer, _ResourceId | extend Duration = datetime_diff(\"minute\",now(),TimeGenerated) | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \"_amba-Heartbeat-threshold-override_\", tostring(tags.[\"_amba-Heartbeat-threshold-override_\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where Duration > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Duration', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'), parameters('threshold'))]" + }, + { + "field": "identity.userAssignedIdentities", + "containsKey": "[[parameters('UAMIResourceId')]" } ] }, @@ -290,6 +325,9 @@ "alertResourceGroupLocation": { "type": "string" }, + "UAMIResourceId": { + "type": "string" + }, "severity": { "type": "String" }, @@ -325,6 +363,15 @@ }, "evaluationPeriods": { "type": "String" + }, + "computersToInclude": { + "type": "array" + }, + "MonitorDisableTagName": { + "type": "String" + }, + "MonitorDisableTagValues": { + "type": "Array" } }, "variables": {}, @@ -358,6 +405,9 @@ }, "alertResourceGroupLocation": { "type": "string" + }, + "UAMIResourceId": { + "type": "string" } }, "variables": {}, @@ -367,6 +417,12 @@ "apiVersion": "2022-08-01-preview", "name": "[[concat(subscription().displayName, '-VMHeartBeatAlert')]", "location": "[[parameters('alertResourceGroupLocation')]", + "identity": { + "type": "UserAssigned", + "userAssignedIdentities": { + "[[parameters('UAMIResourceId')]": {} + } + }, "tags": { "_deployed_by_amba": true }, @@ -386,9 +442,8 @@ "criteria": { "allOf": [ { - "query": "Heartbeat| summarize TimeGenerated=max(TimeGenerated) by Computer, _ResourceId| extend Duration = datetime_diff('minute',now(),TimeGenerated)| summarize AggregatedValue = min(Duration) by Computer, bin(TimeGenerated,5m), _ResourceId", - "metricMeasureColumn": "AggregatedValue", - "threshold": "[[parameters('threshold')]", + "query": "[[format('let policyThresholdString = \"{2}\"; let excludedResources = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\"{1}\")); let excludedVMSSNodes = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | project _ResourceId = tolower(id), tags | where tags contains \"_amba-Heartbeat-threshold-override_\"); Heartbeat | where _ResourceId has \"Microsoft.Compute/virtualMachines\" | where _ResourceId !in~ (excludedResources) | summarize TimeGenerated=max(TimeGenerated) by Computer, _ResourceId | extend Duration = datetime_diff(\"minute\",now(),TimeGenerated) | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \"_amba-Heartbeat-threshold-override_\", tostring(tags.[\"_amba-Heartbeat-threshold-override_\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where Duration > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Duration', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'), parameters('threshold'))]", + "threshold": 0, "operator": "[[parameters('operator')]", "resourceIdColumn": "_ResourceId", "timeAggregation": "[[parameters('timeAggregation')]", @@ -396,9 +451,7 @@ { "name": "Computer", "operator": "Include", - "values": [ - "*" - ] + "values": "[[parameters('computersToInclude')]" } ], "failingPeriods": { @@ -420,6 +473,9 @@ "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" + }, "severity": { "value": "[[parameters('severity')]" }, @@ -449,6 +505,15 @@ }, "evaluationPeriods": { "value": "[[parameters('evaluationPeriods')]" + }, + "computersToInclude": { + "value": "[[parameters('computersToInclude')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('MonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('MonitorDisableTagValues')]" } } } @@ -464,6 +529,9 @@ }, "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" + }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" } } } @@ -480,6 +548,9 @@ "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" + }, "severity": { "value": "[[parameters('severity')]" }, @@ -515,6 +586,15 @@ }, "evaluationPeriods": { "value": "[[parameters('evaluationPeriods')]" + }, + "computersToInclude": { + "value": "[[parameters('computersToInclude')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('MonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('MonitorDisableTagValues')]" } } } diff --git a/services/Compute/virtualMachines/Deploy-VM-NetworkIn-Alert.json b/services/Compute/virtualMachines/Deploy-VM-NetworkIn-Alert.json index 3d6721e23..77c80da30 100644 --- a/services/Compute/virtualMachines/Deploy-VM-NetworkIn-Alert.json +++ b/services/Compute/virtualMachines/Deploy-VM-NetworkIn-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy VM Network Read Alert", "description": "Policy to audit/deploy VM Network Read Alert", "metadata": { - "version": "1.2.0", + "version": "1.4.0", "category": "Compute", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -23,7 +23,7 @@ "displayName": "Resource Group Name", "description": "Resource group the alert is placed in" }, - "defaultValue": "AlzMonitoring-rg" + "defaultValue": "rg-amba-monitoring-001" }, "alertResourceGroupTags": { "type": "Object", @@ -32,7 +32,7 @@ "description": "Tags on the Resource group the alert is placed in" }, "defaultValue": { - "environment": "test" + "Project": "amba-monitoring" } }, "alertResourceGroupLocation": { @@ -43,6 +43,14 @@ }, "defaultValue": "centralus" }, + "UAMIResourceId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "The resource Id of the user assigned managed identity.", + "displayName": "User Assigned managed Identity resource Id." + } + }, "severity": { "type": "String", "metadata": { @@ -64,11 +72,7 @@ "displayName": "Operator" }, "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" + "GreaterThan" ], "defaultValue": "GreaterThan" }, @@ -78,13 +82,9 @@ "displayName": "TimeAggregation" }, "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" + "Count" ], - "defaultValue": "Average" + "defaultValue": "Count" }, "windowSize": { "type": "String", @@ -185,16 +185,6 @@ }, "defaultValue": "1" }, - "networkInterfacesToInclude": { - "type": "array", - "metadata": { - "displayName": "Network Interface to be included to be monitored", - "description": "Array of Network Interface to be monitored" - }, - "defaultValue": [ - "*" - ] - }, "computersToInclude": { "type": "array", "metadata": { @@ -216,6 +206,27 @@ "disabled" ], "defaultValue": "deployIfNotExists" + }, + "MonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name to disable monitoring. Set to true if monitoring should be disabled" + }, + "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -224,6 +235,10 @@ { "field": "type", "equals": "Microsoft.Compute/virtualMachines" + }, + { + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -234,7 +249,7 @@ "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c" ], "type": "Microsoft.Insights/scheduledQueryRules", - "existenceScope": "resourcegroup", + "existenceScope": "resourceGroup", "resourceGroupName": "[[parameters('alertResourceGroupName')]", "deploymentScope": "subscription", "existenceCondition": { @@ -244,33 +259,29 @@ "equals": "[[concat(subscription().displayName, '-VMHighNetworkInAlert')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/scopes[*]", + "field": "Microsoft.Insights/scheduledQueryRules/scopes[*]", "equals": "[[subscription().id]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/enabled", + "field": "Microsoft.Insights/scheduledQueryRules/enabled", "equals": "[[parameters('enabled')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/evaluationFrequency", + "field": "Microsoft.Insights/scheduledQueryRules/evaluationFrequency", "equals": "[[parameters('evaluationFrequency')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/windowSize", + "field": "Microsoft.Insights/scheduledQueryRules/windowSize", "equals": "[[parameters('windowSize')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/severity", + "field": "Microsoft.Insights/scheduledQueryRules/severity", "equals": "[[parameters('severity')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/autoMitigate", + "field": "Microsoft.Insights/scheduledQueryRules/autoMitigate", "equals": "[[parameters('autoMitigate')]" }, - { - "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold", - "equals": "[[parameters('threshold')]" - }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator", "equals": "[[parameters('operator')]" @@ -289,7 +300,11 @@ }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query", - "equals": "InsightsMetrics| where Origin == \"vm.azm.ms\"| where Namespace == \"Network\" and Name == \"ReadBytesPerSecond\"| extend NetworkInterface=tostring(todynamic(Tags)[\"vm.azm.ms/networkDeviceId\"])|summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface" + "equals": "[[format('let policyThresholdString = \"{2}\"; let excludedResources = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\"{1}\")); let excludedVMSSNodes = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | project _ResourceId = tolower(id), tags | where tags contains \"_amba-ReadBytesPerSecond-Data-threshold-override_\"); InsightsMetrics | where _ResourceId has \"Microsoft.Compute/virtualMachines\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \"vm.azm.ms\" | where Namespace == \"Network\" and Name == \"ReadBytesPerSecond\" | extend NetworkInterface=tostring(todynamic(Tags)[\"vm.azm.ms/networkDeviceId\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \"_amba-ReadBytesPerSecond-Data-threshold-override_\", tostring(tags.[\"_amba-ReadBytesPerSecond-Data-threshold-override_\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'), parameters('threshold'))]" + }, + { + "field": "identity.userAssignedIdentities", + "containsKey": "[[parameters('UAMIResourceId')]" } ] }, @@ -310,6 +325,9 @@ "alertResourceGroupLocation": { "type": "string" }, + "UAMIResourceId": { + "type": "string" + }, "severity": { "type": "String" }, @@ -349,8 +367,11 @@ "computersToInclude": { "type": "array" }, - "networkInterfacesToInclude": { - "type": "array" + "MonitorDisableTagName": { + "type": "String" + }, + "MonitorDisableTagValues": { + "type": "Array" } }, "variables": {}, @@ -384,6 +405,9 @@ }, "alertResourceGroupLocation": { "type": "string" + }, + "UAMIResourceId": { + "type": "string" } }, "variables": {}, @@ -393,6 +417,12 @@ "apiVersion": "2022-08-01-preview", "name": "[[concat(subscription().displayName, '-VMHighNetworkInAlert')]", "location": "[[parameters('alertResourceGroupLocation')]", + "identity": { + "type": "UserAssigned", + "userAssignedIdentities": { + "[[parameters('UAMIResourceId')]": {} + } + }, "tags": { "_deployed_by_amba": true }, @@ -412,9 +442,8 @@ "criteria": { "allOf": [ { - "query": "InsightsMetrics| where Origin == \"vm.azm.ms\"| where Namespace == \"Network\" and Name == \"ReadBytesPerSecond\"| extend NetworkInterface=tostring(todynamic(Tags)[\"vm.azm.ms/networkDeviceId\"])|summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface", - "metricMeasureColumn": "AggregatedValue", - "threshold": "[[parameters('threshold')]", + "query": "[[format('let policyThresholdString = \"{2}\"; let excludedResources = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\"{1}\")); let excludedVMSSNodes = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | project _ResourceId = tolower(id), tags | where tags contains \"_amba-ReadBytesPerSecond-Data-threshold-override_\"); InsightsMetrics | where _ResourceId has \"Microsoft.Compute/virtualMachines\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \"vm.azm.ms\" | where Namespace == \"Network\" and Name == \"ReadBytesPerSecond\" | extend NetworkInterface=tostring(todynamic(Tags)[\"vm.azm.ms/networkDeviceId\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \"_amba-ReadBytesPerSecond-Data-threshold-override_\", tostring(tags.[\"_amba-ReadBytesPerSecond-Data-threshold-override_\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'), parameters('threshold'))]", + "threshold": 0, "operator": "[[parameters('operator')]", "resourceIdColumn": "_ResourceId", "timeAggregation": "[[parameters('timeAggregation')]", @@ -427,7 +456,9 @@ { "name": "NetworkInterface", "operator": "Include", - "values": "[[parameters('networkInterfacesToInclude')]" + "values": [ + "*" + ] } ], "failingPeriods": { @@ -449,6 +480,9 @@ "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" + }, "severity": { "value": "[[parameters('severity')]" }, @@ -482,8 +516,11 @@ "computersToInclude": { "value": "[[parameters('computersToInclude')]" }, - "networkInterfacesToInclude": { - "value": "[[parameters('networkInterfacesToInclude')]" + "MonitorDisableTagName": { + "value": "[[parameters('MonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('MonitorDisableTagValues')]" } } } @@ -499,6 +536,9 @@ }, "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" + }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" } } } @@ -515,6 +555,9 @@ "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" + }, "severity": { "value": "[[parameters('severity')]" }, @@ -554,8 +597,11 @@ "computersToInclude": { "value": "[[parameters('computersToInclude')]" }, - "networkInterfacesToInclude": { - "value": "[[parameters('networkInterfacesToInclude')]" + "MonitorDisableTagName": { + "value": "[[parameters('MonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('MonitorDisableTagValues')]" } } } diff --git a/services/Compute/virtualMachines/Deploy-VM-NetworkOut-Alert.json b/services/Compute/virtualMachines/Deploy-VM-NetworkOut-Alert.json index 643ce24ab..83219eae2 100644 --- a/services/Compute/virtualMachines/Deploy-VM-NetworkOut-Alert.json +++ b/services/Compute/virtualMachines/Deploy-VM-NetworkOut-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy VM Network Write Alert", "description": "Policy to audit/deploy VM Network Out Alert", "metadata": { - "version": "1.2.0", + "version": "1.4.0", "category": "Compute", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -23,7 +23,7 @@ "displayName": "Resource Group Name", "description": "Resource group the alert is placed in" }, - "defaultValue": "AlzMonitoring-rg" + "defaultValue": "rg-amba-monitoring-001" }, "alertResourceGroupTags": { "type": "Object", @@ -32,7 +32,7 @@ "description": "Tags on the Resource group the alert is placed in" }, "defaultValue": { - "environment": "test" + "Project": "amba-monitoring" } }, "alertResourceGroupLocation": { @@ -43,6 +43,14 @@ }, "defaultValue": "centralus" }, + "UAMIResourceId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "The resource Id of the user assigned managed identity.", + "displayName": "User Assigned managed Identity resource Id." + } + }, "severity": { "type": "String", "metadata": { @@ -64,11 +72,7 @@ "displayName": "Operator" }, "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" + "GreaterThan" ], "defaultValue": "GreaterThan" }, @@ -78,13 +82,9 @@ "displayName": "TimeAggregation" }, "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" + "Count" ], - "defaultValue": "Average" + "defaultValue": "Count" }, "windowSize": { "type": "String", @@ -195,16 +195,6 @@ "*" ] }, - "networkInterfacesToInclude": { - "type": "array", - "metadata": { - "displayName": "Network Interface to be included to be monitored", - "description": "Array of Network Interface to be monitored" - }, - "defaultValue": [ - "*" - ] - }, "effect": { "type": "String", "metadata": { @@ -216,6 +206,27 @@ "disabled" ], "defaultValue": "deployIfNotExists" + }, + "MonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name to disable monitoring. Set to true if monitoring should be disabled" + }, + "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -224,6 +235,10 @@ { "field": "type", "equals": "Microsoft.Compute/virtualMachines" + }, + { + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -234,7 +249,7 @@ "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c" ], "type": "Microsoft.Insights/scheduledQueryRules", - "existenceScope": "resourcegroup", + "existenceScope": "resourceGroup", "resourceGroupName": "[[parameters('alertResourceGroupName')]", "deploymentScope": "subscription", "existenceCondition": { @@ -244,33 +259,29 @@ "equals": "[[concat(subscription().displayName, '-VMHighNetworkOutAlert')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/scopes[*]", + "field": "Microsoft.Insights/scheduledQueryRules/scopes[*]", "equals": "[[subscription().id]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/enabled", + "field": "Microsoft.Insights/scheduledQueryRules/enabled", "equals": "[[parameters('enabled')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/evaluationFrequency", + "field": "Microsoft.Insights/scheduledQueryRules/evaluationFrequency", "equals": "[[parameters('evaluationFrequency')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/windowSize", + "field": "Microsoft.Insights/scheduledQueryRules/windowSize", "equals": "[[parameters('windowSize')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/severity", + "field": "Microsoft.Insights/scheduledQueryRules/severity", "equals": "[[parameters('severity')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/autoMitigate", + "field": "Microsoft.Insights/scheduledQueryRules/autoMitigate", "equals": "[[parameters('autoMitigate')]" }, - { - "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold", - "equals": "[[parameters('threshold')]" - }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator", "equals": "[[parameters('operator')]" @@ -289,7 +300,11 @@ }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query", - "equals": "InsightsMetrics| where Origin == \"vm.azm.ms\"| where Namespace == \"Network\" and Name == \"WriteBytesPerSecond\"| extend NetworkInterface=tostring(todynamic(Tags)[\"vm.azm.ms/networkDeviceId\"])|summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface" + "equals": "[[format('let policyThresholdString = \"{2}\"; let excludedResources = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\"{1}\")); let excludedVMSSNodes = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | project _ResourceId = tolower(id), tags | where tags contains \"_amba-WriteBytesPerSecond-Data-threshold-override_\"); InsightsMetrics | where _ResourceId has \"Microsoft.Compute/virtualMachines\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \"vm.azm.ms\" | where Namespace == \"Network\" and Name == \"WriteBytesPerSecond\" | extend NetworkInterface=tostring(todynamic(Tags)[\"vm.azm.ms/networkDeviceId\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \"_amba-WriteBytesPerSecond-Data-threshold-override_\", tostring(tags.[\"_amba-WriteBytesPerSecond-Data-threshold-override_\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'), parameters('threshold'))]" + }, + { + "field": "identity.userAssignedIdentities", + "containsKey": "[[parameters('UAMIResourceId')]" } ] }, @@ -310,6 +325,9 @@ "alertResourceGroupLocation": { "type": "string" }, + "UAMIResourceId": { + "type": "string" + }, "severity": { "type": "String" }, @@ -349,8 +367,11 @@ "computersToInclude": { "type": "array" }, - "networkInterfacesToInclude": { - "type": "array" + "MonitorDisableTagName": { + "type": "String" + }, + "MonitorDisableTagValues": { + "type": "Array" } }, "variables": {}, @@ -384,6 +405,9 @@ }, "alertResourceGroupLocation": { "type": "string" + }, + "UAMIResourceId": { + "type": "string" } }, "variables": {}, @@ -393,6 +417,12 @@ "apiVersion": "2022-08-01-preview", "name": "[[concat(subscription().displayName, '-VMHighNetworkOutAlert')]", "location": "[[parameters('alertResourceGroupLocation')]", + "identity": { + "type": "UserAssigned", + "userAssignedIdentities": { + "[[parameters('UAMIResourceId')]": {} + } + }, "tags": { "_deployed_by_amba": true }, @@ -412,9 +442,8 @@ "criteria": { "allOf": [ { - "query": "InsightsMetrics| where Origin == \"vm.azm.ms\"| where Namespace == \"Network\" and Name == \"WriteBytesPerSecond\"| extend NetworkInterface=tostring(todynamic(Tags)[\"vm.azm.ms/networkDeviceId\"])|summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface", - "metricMeasureColumn": "AggregatedValue", - "threshold": "[[parameters('threshold')]", + "query": "[[format('let policyThresholdString = \"{2}\"; let excludedResources = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\"{1}\")); let excludedVMSSNodes = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | project _ResourceId = tolower(id), tags | where tags contains \"_amba-WriteBytesPerSecond-Data-threshold-override_\"); InsightsMetrics | where _ResourceId has \"Microsoft.Compute/virtualMachines\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \"vm.azm.ms\" | where Namespace == \"Network\" and Name == \"WriteBytesPerSecond\" | extend NetworkInterface=tostring(todynamic(Tags)[\"vm.azm.ms/networkDeviceId\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \"_amba-WriteBytesPerSecond-Data-threshold-override_\", tostring(tags.[\"_amba-WriteBytesPerSecond-Data-threshold-override_\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'), parameters('threshold'))]", + "threshold": 0, "operator": "[[parameters('operator')]", "resourceIdColumn": "_ResourceId", "timeAggregation": "[[parameters('timeAggregation')]", @@ -427,7 +456,9 @@ { "name": "NetworkInterface", "operator": "Include", - "values": "[[parameters('networkInterfacesToInclude')]" + "values": [ + "*" + ] } ], "failingPeriods": { @@ -449,6 +480,9 @@ "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" + }, "severity": { "value": "[[parameters('severity')]" }, @@ -482,8 +516,11 @@ "computersToInclude": { "value": "[[parameters('computersToInclude')]" }, - "networkInterfacesToInclude": { - "value": "[[parameters('networkInterfacesToInclude')]" + "MonitorDisableTagName": { + "value": "[[parameters('MonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('MonitorDisableTagValues')]" } } } @@ -499,6 +536,9 @@ }, "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" + }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" } } } @@ -515,6 +555,9 @@ "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" + }, "severity": { "value": "[[parameters('severity')]" }, @@ -554,8 +597,11 @@ "computersToInclude": { "value": "[[parameters('computersToInclude')]" }, - "networkInterfacesToInclude": { - "value": "[[parameters('networkInterfacesToInclude')]" + "MonitorDisableTagName": { + "value": "[[parameters('MonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('MonitorDisableTagValues')]" } } } diff --git a/services/Compute/virtualMachines/Deploy-VM-OSDiskReadLatency-Alert.json b/services/Compute/virtualMachines/Deploy-VM-OSDiskReadLatency-Alert.json index 78bd96dc8..130f0b459 100644 --- a/services/Compute/virtualMachines/Deploy-VM-OSDiskReadLatency-Alert.json +++ b/services/Compute/virtualMachines/Deploy-VM-OSDiskReadLatency-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy VM OS Disk Read Latency Alert", "description": "Policy to audit/deploy VM OSDiskreadLatency Alert", "metadata": { - "version": "1.2.0", + "version": "1.4.0", "category": "Compute", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -23,7 +23,7 @@ "displayName": "Resource Group Name", "description": "Resource group the alert is placed in" }, - "defaultValue": "AlzMonitoring-rg" + "defaultValue": "rg-amba-monitoring-001" }, "alertResourceGroupTags": { "type": "Object", @@ -32,7 +32,7 @@ "description": "Tags on the Resource group the alert is placed in" }, "defaultValue": { - "environment": "test" + "Project": "amba-monitoring" } }, "alertResourceGroupLocation": { @@ -43,6 +43,14 @@ }, "defaultValue": "centralus" }, + "UAMIResourceId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "The resource Id of the user assigned managed identity.", + "displayName": "User Assigned managed Identity resource Id." + } + }, "severity": { "type": "String", "metadata": { @@ -64,11 +72,7 @@ "displayName": "Operator" }, "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" + "GreaterThan" ], "defaultValue": "GreaterThan" }, @@ -78,13 +82,9 @@ "displayName": "TimeAggregation" }, "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" + "Count" ], - "defaultValue": "Average" + "defaultValue": "Count" }, "windowSize": { "type": "String", @@ -188,24 +188,13 @@ "computersToInclude": { "type": "array", "metadata": { - "displayName": "Disks to be included to be monitored", + "displayName": "Computers to be included to be monitored", "description": "Array of Computer to be monitored" }, "defaultValue": [ "*" ] }, - "disksToInclude": { - "type": "array", - "metadata": { - "displayName": "Disks to be included to be monitored", - "description": "Array of disk to be monitored for disk both windows and linux" - }, - "defaultValue": [ - "C:", - "/" - ] - }, "effect": { "type": "String", "metadata": { @@ -217,6 +206,27 @@ "disabled" ], "defaultValue": "deployIfNotExists" + }, + "MonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name to disable monitoring. Set to true if monitoring should be disabled" + }, + "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -225,6 +235,10 @@ { "field": "type", "equals": "Microsoft.Compute/virtualMachines" + }, + { + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -235,43 +249,39 @@ "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c" ], "type": "Microsoft.Insights/scheduledQueryRules", - "existenceScope": "resourcegroup", + "existenceScope": "resourceGroup", "resourceGroupName": "[[parameters('alertResourceGroupName')]", "deploymentScope": "subscription", "existenceCondition": { "allOf": [ { "field": "Microsoft.Insights/scheduledQueryRules/displayName", - "equals": "[[concat(subscription().displayName, '-VMLowOSDiskreadLatencyAlert')]" + "equals": "[[concat(subscription().displayName, '-VMHighOSDiskReadLatencyAlert')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/scopes[*]", + "field": "Microsoft.Insights/scheduledQueryRules/scopes[*]", "equals": "[[subscription().id]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/enabled", + "field": "Microsoft.Insights/scheduledQueryRules/enabled", "equals": "[[parameters('enabled')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/evaluationFrequency", + "field": "Microsoft.Insights/scheduledQueryRules/evaluationFrequency", "equals": "[[parameters('evaluationFrequency')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/windowSize", + "field": "Microsoft.Insights/scheduledQueryRules/windowSize", "equals": "[[parameters('windowSize')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/severity", + "field": "Microsoft.Insights/scheduledQueryRules/severity", "equals": "[[parameters('severity')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/autoMitigate", + "field": "Microsoft.Insights/scheduledQueryRules/autoMitigate", "equals": "[[parameters('autoMitigate')]" }, - { - "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold", - "equals": "[[parameters('threshold')]" - }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator", "equals": "[[parameters('operator')]" @@ -290,7 +300,11 @@ }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query", - "equals": "InsightsMetrics| where Origin == \"vm.azm.ms\"| where Namespace == \"LogicalDisk\" and Name == \"ReadLatencyMs\"| extend Disk=tostring(todynamic(Tags)[\"vm.azm.ms/mountId\"])| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk" + "equals": "[[format('let policyThresholdString = \"{2}\"; let excludedResources = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\"{1}\")); let excludedVMSSNodes = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | project _ResourceId = tolower(id), tags | where tags contains \"_amba-ReadLatencyMs-OS-threshold-override_\"); InsightsMetrics | where _ResourceId has \"Microsoft.Compute/virtualMachines\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \"vm.azm.ms\" | where Namespace == \"LogicalDisk\" and Name == \"ReadLatencyMs\" | extend Disk=tostring(todynamic(Tags)[\"vm.azm.ms/mountId\"]) | where Disk in (\"C:\",\"/\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \"_amba-ReadLatencyMs-OS-threshold-override_\", tostring(tags.[\"_amba-ReadLatencyMs-OS-threshold-override_\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'), parameters('threshold'))]" + }, + { + "field": "identity.userAssignedIdentities", + "containsKey": "[[parameters('UAMIResourceId')]" } ] }, @@ -311,6 +325,9 @@ "alertResourceGroupLocation": { "type": "string" }, + "UAMIResourceId": { + "type": "string" + }, "severity": { "type": "String" }, @@ -347,11 +364,14 @@ "evaluationPeriods": { "type": "String" }, - "disksToInclude": { - "type": "array" - }, "computersToInclude": { "type": "array" + }, + "MonitorDisableTagName": { + "type": "String" + }, + "MonitorDisableTagValues": { + "type": "Array" } }, "variables": {}, @@ -385,6 +405,9 @@ }, "alertResourceGroupLocation": { "type": "string" + }, + "UAMIResourceId": { + "type": "string" } }, "variables": {}, @@ -392,13 +415,19 @@ { "type": "Microsoft.Insights/scheduledQueryRules", "apiVersion": "2022-08-01-preview", - "name": "[[concat(subscription().displayName, '-VMLowOSDiskreadLatencyAlert')]", + "name": "[[concat(subscription().displayName, '-VMHighOSDiskReadLatencyAlert')]", "location": "[[parameters('alertResourceGroupLocation')]", + "identity": { + "type": "UserAssigned", + "userAssignedIdentities": { + "[[parameters('UAMIResourceId')]": {} + } + }, "tags": { "_deployed_by_amba": true }, "properties": { - "displayName": "[[concat(subscription().displayName, '-VMLowOSDiskreadLatencyAlert')]", + "displayName": "[[concat(subscription().displayName, '-VMHighOSDiskReadLatencyAlert')]", "description": "Log Alert for Virtual Machine OSDiskreadLatency", "severity": "[[parameters('severity')]", "enabled": "[[parameters('enabled')]", @@ -413,9 +442,8 @@ "criteria": { "allOf": [ { - "query": "InsightsMetrics| where Origin == \"vm.azm.ms\"| where Namespace == \"LogicalDisk\" and Name == \"ReadLatencyMs\"| extend Disk=tostring(todynamic(Tags)[\"vm.azm.ms/mountId\"])| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk", - "metricMeasureColumn": "AggregatedValue", - "threshold": "[[parameters('threshold')]", + "query": "[[format('let policyThresholdString = \"{2}\"; let excludedResources = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\"{1}\")); let excludedVMSSNodes = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | project _ResourceId = tolower(id), tags | where tags contains \"_amba-ReadLatencyMs-OS-threshold-override_\"); InsightsMetrics | where _ResourceId has \"Microsoft.Compute/virtualMachines\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \"vm.azm.ms\" | where Namespace == \"LogicalDisk\" and Name == \"ReadLatencyMs\" | extend Disk=tostring(todynamic(Tags)[\"vm.azm.ms/mountId\"]) | where Disk in (\"C:\",\"/\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \"_amba-ReadLatencyMs-OS-threshold-override_\", tostring(tags.[\"_amba-ReadLatencyMs-OS-threshold-override_\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'), parameters('threshold'))]", + "threshold": 0, "operator": "[[parameters('operator')]", "resourceIdColumn": "_ResourceId", "timeAggregation": "[[parameters('timeAggregation')]", @@ -428,7 +456,9 @@ { "name": "Disk", "operator": "Include", - "values": "[[parameters('disksToInclude')]" + "values": [ + "*" + ] } ], "failingPeriods": { @@ -450,6 +480,9 @@ "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" + }, "severity": { "value": "[[parameters('severity')]" }, @@ -480,11 +513,14 @@ "evaluationPeriods": { "value": "[[parameters('evaluationPeriods')]" }, - "disksToInclude": { - "value": "[[parameters('disksToInclude')]" - }, "computersToInclude": { "value": "[[parameters('computersToInclude')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('MonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('MonitorDisableTagValues')]" } } } @@ -500,6 +536,9 @@ }, "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" + }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" } } } @@ -516,6 +555,9 @@ "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" + }, "severity": { "value": "[[parameters('severity')]" }, @@ -552,11 +594,14 @@ "evaluationPeriods": { "value": "[[parameters('evaluationPeriods')]" }, - "disksToInclude": { - "value": "[[parameters('disksToInclude')]" - }, "computersToInclude": { "value": "[[parameters('computersToInclude')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('MonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('MonitorDisableTagValues')]" } } } diff --git a/services/Compute/virtualMachines/Deploy-VM-OSDiskSpace-Alert.json b/services/Compute/virtualMachines/Deploy-VM-OSDiskSpace-Alert.json index b50872ee8..e8ef309a8 100644 --- a/services/Compute/virtualMachines/Deploy-VM-OSDiskSpace-Alert.json +++ b/services/Compute/virtualMachines/Deploy-VM-OSDiskSpace-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy VM OS Disk Space Alert", "description": "Policy to audit/deploy VM OSDiskSpace Alert", "metadata": { - "version": "1.2.0", + "version": "1.4.0", "category": "Compute", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -23,7 +23,7 @@ "displayName": "Resource Group Name", "description": "Resource group the alert is placed in" }, - "defaultValue": "AlzMonitoring-rg" + "defaultValue": "rg-amba-monitoring-001" }, "alertResourceGroupTags": { "type": "Object", @@ -32,7 +32,7 @@ "description": "Tags on the Resource group the alert is placed in" }, "defaultValue": { - "environment": "test" + "Project": "amba-monitoring" } }, "alertResourceGroupLocation": { @@ -43,6 +43,14 @@ }, "defaultValue": "centralus" }, + "UAMIResourceId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "The resource Id of the user assigned managed identity.", + "displayName": "User Assigned managed Identity resource Id." + } + }, "severity": { "type": "String", "metadata": { @@ -64,13 +72,9 @@ "displayName": "Operator" }, "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" + "GreaterThan" ], - "defaultValue": "LessThan" + "defaultValue": "GreaterThan" }, "timeAggregation": { "type": "String", @@ -78,13 +82,9 @@ "displayName": "TimeAggregation" }, "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" + "Count" ], - "defaultValue": "Average" + "defaultValue": "Count" }, "windowSize": { "type": "String", @@ -188,24 +188,13 @@ "computersToInclude": { "type": "array", "metadata": { - "displayName": "Disks to be included to be monitored", + "displayName": "Computers to be included to be monitored", "description": "Array of Computer to be monitored" }, "defaultValue": [ "*" ] }, - "disksToInclude": { - "type": "array", - "metadata": { - "displayName": "Disks to be included to be monitored", - "description": "Array of disk to be monitored for disk both windows and linux" - }, - "defaultValue": [ - "C:", - "/" - ] - }, "effect": { "type": "String", "metadata": { @@ -217,6 +206,27 @@ "disabled" ], "defaultValue": "deployIfNotExists" + }, + "MonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name to disable monitoring. Set to true if monitoring should be disabled" + }, + "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -225,6 +235,10 @@ { "field": "type", "equals": "Microsoft.Compute/virtualMachines" + }, + { + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -235,7 +249,7 @@ "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c" ], "type": "Microsoft.Insights/scheduledQueryRules", - "existenceScope": "resourcegroup", + "existenceScope": "resourceGroup", "resourceGroupName": "[[parameters('alertResourceGroupName')]", "deploymentScope": "subscription", "existenceCondition": { @@ -245,33 +259,29 @@ "equals": "[[concat(subscription().displayName, '-VMLowOSDiskSpaceAlert')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/scopes[*]", + "field": "Microsoft.Insights/scheduledQueryRules/scopes[*]", "equals": "[[subscription().id]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/enabled", + "field": "Microsoft.Insights/scheduledQueryRules/enabled", "equals": "[[parameters('enabled')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/evaluationFrequency", + "field": "Microsoft.Insights/scheduledQueryRules/evaluationFrequency", "equals": "[[parameters('evaluationFrequency')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/windowSize", + "field": "Microsoft.Insights/scheduledQueryRules/windowSize", "equals": "[[parameters('windowSize')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/severity", + "field": "Microsoft.Insights/scheduledQueryRules/severity", "equals": "[[parameters('severity')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/autoMitigate", + "field": "Microsoft.Insights/scheduledQueryRules/autoMitigate", "equals": "[[parameters('autoMitigate')]" }, - { - "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold", - "equals": "[[parameters('threshold')]" - }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator", "equals": "[[parameters('operator')]" @@ -290,7 +300,11 @@ }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query", - "equals": "InsightsMetrics| where Origin == \"vm.azm.ms\"| where Namespace == \"LogicalDisk\" and Name == \"FreeSpacePercentage\"| extend Disk=tostring(todynamic(Tags)[\"vm.azm.ms/mountId\"])| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk" + "equals": "[[format('let policyThresholdString = \"{2}\"; let excludedResources = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\"{1}\")); let excludedVMSSNodes = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | project _ResourceId = tolower(id), tags | where tags contains \"_amba-FreeSpacePercentage-OS-threshold-override_\"); InsightsMetrics | where _ResourceId has \"Microsoft.Compute/virtualMachines\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \"vm.azm.ms\" | where Namespace == \"LogicalDisk\" and Name == \"FreeSpacePercentage\" | extend Disk=tostring(todynamic(Tags)[\"vm.azm.ms/mountId\"]) | where Disk in (\"C:\",\"/\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \"_amba-FreeSpacePercentage-OS-threshold-override_\", tostring(tags.[\"_amba-FreeSpacePercentage-OS-threshold-override_\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'), parameters('threshold'))]" + }, + { + "field": "identity.userAssignedIdentities", + "containsKey": "[[parameters('UAMIResourceId')]" } ] }, @@ -311,6 +325,9 @@ "alertResourceGroupLocation": { "type": "string" }, + "UAMIResourceId": { + "type": "string" + }, "severity": { "type": "String" }, @@ -347,11 +364,14 @@ "evaluationPeriods": { "type": "String" }, - "disksToInclude": { - "type": "array" - }, "computersToInclude": { "type": "array" + }, + "MonitorDisableTagName": { + "type": "String" + }, + "MonitorDisableTagValues": { + "type": "Array" } }, "variables": {}, @@ -385,6 +405,9 @@ }, "alertResourceGroupLocation": { "type": "string" + }, + "UAMIResourceId": { + "type": "string" } }, "variables": {}, @@ -394,6 +417,12 @@ "apiVersion": "2022-08-01-preview", "name": "[[concat(subscription().displayName, '-VMLowOSDiskSpaceAlert')]", "location": "[[parameters('alertResourceGroupLocation')]", + "identity": { + "type": "UserAssigned", + "userAssignedIdentities": { + "[[parameters('UAMIResourceId')]": {} + } + }, "tags": { "_deployed_by_amba": true }, @@ -413,9 +442,8 @@ "criteria": { "allOf": [ { - "query": "InsightsMetrics| where Origin == \"vm.azm.ms\"| where Namespace == \"LogicalDisk\" and Name == \"FreeSpacePercentage\"| extend Disk=tostring(todynamic(Tags)[\"vm.azm.ms/mountId\"])| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk", - "metricMeasureColumn": "AggregatedValue", - "threshold": "[[parameters('threshold')]", + "query": "[[format('let policyThresholdString = \"{2}\"; let excludedResources = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\"{1}\")); let excludedVMSSNodes = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | project _ResourceId = tolower(id), tags | where tags contains \"_amba-FreeSpacePercentage-OS-threshold-override_\"); InsightsMetrics | where _ResourceId has \"Microsoft.Compute/virtualMachines\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \"vm.azm.ms\" | where Namespace == \"LogicalDisk\" and Name == \"FreeSpacePercentage\" | extend Disk=tostring(todynamic(Tags)[\"vm.azm.ms/mountId\"]) | where Disk in (\"C:\",\"/\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \"_amba-FreeSpacePercentage-OS-threshold-override_\", tostring(tags.[\"_amba-FreeSpacePercentage-OS-threshold-override_\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'), parameters('threshold'))]", + "threshold": 0, "operator": "[[parameters('operator')]", "resourceIdColumn": "_ResourceId", "timeAggregation": "[[parameters('timeAggregation')]", @@ -428,7 +456,9 @@ { "name": "Disk", "operator": "Include", - "values": "[[parameters('disksToInclude')]" + "values": [ + "*" + ] } ], "failingPeriods": { @@ -450,6 +480,9 @@ "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" + }, "severity": { "value": "[[parameters('severity')]" }, @@ -480,11 +513,14 @@ "evaluationPeriods": { "value": "[[parameters('evaluationPeriods')]" }, - "disksToInclude": { - "value": "[[parameters('disksToInclude')]" - }, "computersToInclude": { "value": "[[parameters('computersToInclude')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('MonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('MonitorDisableTagValues')]" } } } @@ -500,6 +536,9 @@ }, "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" + }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" } } } @@ -516,6 +555,9 @@ "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" + }, "severity": { "value": "[[parameters('severity')]" }, @@ -552,11 +594,14 @@ "evaluationPeriods": { "value": "[[parameters('evaluationPeriods')]" }, - "disksToInclude": { - "value": "[[parameters('disksToInclude')]" - }, "computersToInclude": { "value": "[[parameters('computersToInclude')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('MonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('MonitorDisableTagValues')]" } } } diff --git a/services/Compute/virtualMachines/Deploy-VM-OSDiskWriteLatency-Alert.json b/services/Compute/virtualMachines/Deploy-VM-OSDiskWriteLatency-Alert.json index 4050ed95e..2aab66dc1 100644 --- a/services/Compute/virtualMachines/Deploy-VM-OSDiskWriteLatency-Alert.json +++ b/services/Compute/virtualMachines/Deploy-VM-OSDiskWriteLatency-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy VM OS Disk Write Latency Alert", "description": "Policy to audit/deploy VM OSDiskwriteLatency Alert", "metadata": { - "version": "1.2.0", + "version": "1.4.0", "category": "Compute", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -23,7 +23,7 @@ "displayName": "Resource Group Name", "description": "Resource group the alert is placed in" }, - "defaultValue": "AlzMonitoring-rg" + "defaultValue": "rg-amba-monitoring-001" }, "alertResourceGroupTags": { "type": "Object", @@ -32,7 +32,7 @@ "description": "Tags on the Resource group the alert is placed in" }, "defaultValue": { - "environment": "test" + "Project": "amba-monitoring" } }, "alertResourceGroupLocation": { @@ -43,6 +43,14 @@ }, "defaultValue": "centralus" }, + "UAMIResourceId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "The resource Id of the user assigned managed identity.", + "displayName": "User Assigned managed Identity resource Id." + } + }, "severity": { "type": "String", "metadata": { @@ -64,11 +72,7 @@ "displayName": "Operator" }, "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" + "GreaterThan" ], "defaultValue": "GreaterThan" }, @@ -78,13 +82,9 @@ "displayName": "TimeAggregation" }, "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" + "Count" ], - "defaultValue": "Average" + "defaultValue": "Count" }, "windowSize": { "type": "String", @@ -167,7 +167,7 @@ "displayName": "Threshold", "description": "Threshold for the alert" }, - "defaultValue": "50" + "defaultValue": "30" }, "failingPeriods": { "type": "String", @@ -188,24 +188,13 @@ "computersToInclude": { "type": "array", "metadata": { - "displayName": "Disks to be included to be monitored", + "displayName": "Computers to be included to be monitored", "description": "Array of Computer to be monitored" }, "defaultValue": [ "*" ] }, - "disksToInclude": { - "type": "array", - "metadata": { - "displayName": "Disks to be included to be monitored", - "description": "Array of disk to be monitored for disk both windows and linux" - }, - "defaultValue": [ - "C:", - "/" - ] - }, "effect": { "type": "String", "metadata": { @@ -217,6 +206,27 @@ "disabled" ], "defaultValue": "deployIfNotExists" + }, + "MonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name to disable monitoring. Set to true if monitoring should be disabled" + }, + "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -225,6 +235,10 @@ { "field": "type", "equals": "Microsoft.Compute/virtualMachines" + }, + { + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -235,43 +249,39 @@ "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c" ], "type": "Microsoft.Insights/scheduledQueryRules", - "existenceScope": "resourcegroup", + "existenceScope": "resourceGroup", "resourceGroupName": "[[parameters('alertResourceGroupName')]", "deploymentScope": "subscription", "existenceCondition": { "allOf": [ { "field": "Microsoft.Insights/scheduledQueryRules/displayName", - "equals": "[[concat(subscription().displayName, '-VMLowOSDiskwriteLatencyAlert')]" + "equals": "[[concat(subscription().displayName, '-VMHighOSDiskWriteLatencyAlert')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/scopes[*]", + "field": "Microsoft.Insights/scheduledQueryRules/scopes[*]", "equals": "[[subscription().id]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/enabled", + "field": "Microsoft.Insights/scheduledQueryRules/enabled", "equals": "[[parameters('enabled')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/evaluationFrequency", + "field": "Microsoft.Insights/scheduledQueryRules/evaluationFrequency", "equals": "[[parameters('evaluationFrequency')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/windowSize", + "field": "Microsoft.Insights/scheduledQueryRules/windowSize", "equals": "[[parameters('windowSize')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/severity", + "field": "Microsoft.Insights/scheduledQueryRules/severity", "equals": "[[parameters('severity')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/autoMitigate", + "field": "Microsoft.Insights/scheduledQueryRules/autoMitigate", "equals": "[[parameters('autoMitigate')]" }, - { - "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold", - "equals": "[[parameters('threshold')]" - }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator", "equals": "[[parameters('operator')]" @@ -290,7 +300,11 @@ }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query", - "equals": "InsightsMetrics| where Origin == \"vm.azm.ms\"| where Namespace == \"LogicalDisk\" and Name == \"WriteLatencyMs\"| extend Disk=tostring(todynamic(Tags)[\"vm.azm.ms/mountId\"])| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk" + "equals": "[[format('let policyThresholdString = \"{2}\"; let excludedResources = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\"{1}\")); let excludedVMSSNodes = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | project _ResourceId = tolower(id), tags | where tags contains \"_amba-WriteLatencyMs-OS-threshold-override_\"); InsightsMetrics | where _ResourceId has \"Microsoft.Compute/virtualMachines\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \"vm.azm.ms\" | where Namespace == \"LogicalDisk\" and Name == \"WriteLatencyMs\" | extend Disk=tostring(todynamic(Tags)[\"vm.azm.ms/mountId\"]) | where Disk in (\"C:\",\"/\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \"_amba-WriteLatencyMs-OS-threshold-override_\", tostring(tags.[\"_amba-WriteLatencyMs-OS-threshold-override_\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'), parameters('threshold'))]" + }, + { + "field": "identity.userAssignedIdentities", + "containsKey": "[[parameters('UAMIResourceId')]" } ] }, @@ -311,6 +325,9 @@ "alertResourceGroupLocation": { "type": "string" }, + "UAMIResourceId": { + "type": "string" + }, "severity": { "type": "String" }, @@ -347,11 +364,14 @@ "evaluationPeriods": { "type": "String" }, - "disksToInclude": { - "type": "array" - }, "computersToInclude": { "type": "array" + }, + "MonitorDisableTagName": { + "type": "String" + }, + "MonitorDisableTagValues": { + "type": "Array" } }, "variables": {}, @@ -385,6 +405,9 @@ }, "alertResourceGroupLocation": { "type": "string" + }, + "UAMIResourceId": { + "type": "string" } }, "variables": {}, @@ -392,13 +415,19 @@ { "type": "Microsoft.Insights/scheduledQueryRules", "apiVersion": "2022-08-01-preview", - "name": "[[concat(subscription().displayName, '-VMLowOSDiskwriteLatencyAlert')]", + "name": "[[concat(subscription().displayName, '-VMHighOSDiskWriteLatencyAlert')]", "location": "[[parameters('alertResourceGroupLocation')]", + "identity": { + "type": "UserAssigned", + "userAssignedIdentities": { + "[[parameters('UAMIResourceId')]": {} + } + }, "tags": { "_deployed_by_amba": true }, "properties": { - "displayName": "[[concat(subscription().displayName, '-VMLowOSDiskwriteLatencyAlert')]", + "displayName": "[[concat(subscription().displayName, '-VMHighOSDiskWriteLatencyAlert')]", "description": "Log Alert for Virtual Machine OSDiskwriteLatency", "severity": "[[parameters('severity')]", "enabled": "[[parameters('enabled')]", @@ -413,9 +442,8 @@ "criteria": { "allOf": [ { - "query": "InsightsMetrics| where Origin == \"vm.azm.ms\"| where Namespace == \"LogicalDisk\" and Name == \"WriteLatencyMs\"| extend Disk=tostring(todynamic(Tags)[\"vm.azm.ms/mountId\"])| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk", - "metricMeasureColumn": "AggregatedValue", - "threshold": "[[parameters('threshold')]", + "query": "[[format('let policyThresholdString = \"{2}\"; let excludedResources = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\"{1}\")); let excludedVMSSNodes = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | project _ResourceId = tolower(id), tags | where tags contains \"_amba-WriteLatencyMs-OS-threshold-override_\"); InsightsMetrics | where _ResourceId has \"Microsoft.Compute/virtualMachines\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \"vm.azm.ms\" | where Namespace == \"LogicalDisk\" and Name == \"WriteLatencyMs\" | extend Disk=tostring(todynamic(Tags)[\"vm.azm.ms/mountId\"]) | where Disk in (\"C:\",\"/\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \"_amba-WriteLatencyMs-OS-threshold-override_\", tostring(tags.[\"_amba-WriteLatencyMs-OS-threshold-override_\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'), parameters('threshold'))]", + "threshold": 0, "operator": "[[parameters('operator')]", "resourceIdColumn": "_ResourceId", "timeAggregation": "[[parameters('timeAggregation')]", @@ -428,7 +456,9 @@ { "name": "Disk", "operator": "Include", - "values": "[[parameters('disksToInclude')]" + "values": [ + "*" + ] } ], "failingPeriods": { @@ -450,6 +480,9 @@ "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" + }, "severity": { "value": "[[parameters('severity')]" }, @@ -480,11 +513,14 @@ "evaluationPeriods": { "value": "[[parameters('evaluationPeriods')]" }, - "disksToInclude": { - "value": "[[parameters('disksToInclude')]" - }, "computersToInclude": { "value": "[[parameters('computersToInclude')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('MonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('MonitorDisableTagValues')]" } } } @@ -500,6 +536,9 @@ }, "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" + }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" } } } @@ -516,6 +555,9 @@ "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" + }, "severity": { "value": "[[parameters('severity')]" }, @@ -552,11 +594,14 @@ "evaluationPeriods": { "value": "[[parameters('evaluationPeriods')]" }, - "disksToInclude": { - "value": "[[parameters('disksToInclude')]" - }, "computersToInclude": { "value": "[[parameters('computersToInclude')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('MonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('MonitorDisableTagValues')]" } } } diff --git a/services/Compute/virtualMachines/Deploy-VM-PercentCPU-Alert.json b/services/Compute/virtualMachines/Deploy-VM-PercentCPU-Alert.json index 0d716ea56..54ccac4ec 100644 --- a/services/Compute/virtualMachines/Deploy-VM-PercentCPU-Alert.json +++ b/services/Compute/virtualMachines/Deploy-VM-PercentCPU-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy VM CPU Alert", "description": "Policy to audit/deploy VM CPU Alert", "metadata": { - "version": "1.2.0", + "version": "1.4.0", "category": "Compute", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -23,7 +23,7 @@ "displayName": "Resource Group Name", "description": "Resource group the alert is placed in" }, - "defaultValue": "AlzMonitoring-rg" + "defaultValue": "rg-amba-monitoring-001" }, "alertResourceGroupTags": { "type": "Object", @@ -32,7 +32,7 @@ "description": "Tags on the Resource group the alert is placed in" }, "defaultValue": { - "environment": "test" + "Project": "amba-monitoring" } }, "alertResourceGroupLocation": { @@ -43,6 +43,14 @@ }, "defaultValue": "centralus" }, + "UAMIResourceId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "The resource Id of the user assigned managed identity.", + "displayName": "User Assigned managed Identity resource Id." + } + }, "severity": { "type": "String", "metadata": { @@ -64,11 +72,7 @@ "displayName": "Operator" }, "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" + "GreaterThan" ], "defaultValue": "GreaterThan" }, @@ -78,13 +82,9 @@ "displayName": "TimeAggregation" }, "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" + "Count" ], - "defaultValue": "Average" + "defaultValue": "Count" }, "windowSize": { "type": "String", @@ -177,6 +177,14 @@ }, "defaultValue": "1" }, + "evaluationPeriods": { + "type": "String", + "metadata": { + "displayName": "Evaluation Periods", + "description": "The number of aggregated lookback points." + }, + "defaultValue": "1" + }, "effect": { "type": "String", "metadata": { @@ -188,6 +196,27 @@ "disabled" ], "defaultValue": "deployIfNotExists" + }, + "MonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name to disable monitoring. Set to true if monitoring should be disabled" + }, + "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -196,6 +225,10 @@ { "field": "type", "equals": "Microsoft.Compute/virtualMachines" + }, + { + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -206,7 +239,7 @@ "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c" ], "type": "Microsoft.Insights/scheduledQueryRules", - "existenceScope": "resourcegroup", + "existenceScope": "resourceGroup", "resourceGroupName": "[[parameters('alertResourceGroupName')]", "deploymentScope": "subscription", "existenceCondition": { @@ -216,33 +249,29 @@ "equals": "[[concat(subscription().displayName, '-VMHighCPUAlert')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/scopes[*]", + "field": "Microsoft.Insights/scheduledQueryRules/scopes[*]", "equals": "[[subscription().id]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/enabled", + "field": "Microsoft.Insights/scheduledQueryRules/enabled", "equals": "[[parameters('enabled')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/evaluationFrequency", + "field": "Microsoft.Insights/scheduledQueryRules/evaluationFrequency", "equals": "[[parameters('evaluationFrequency')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/windowSize", + "field": "Microsoft.Insights/scheduledQueryRules/windowSize", "equals": "[[parameters('windowSize')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/severity", + "field": "Microsoft.Insights/scheduledQueryRules/severity", "equals": "[[parameters('severity')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/autoMitigate", + "field": "Microsoft.Insights/scheduledQueryRules/autoMitigate", "equals": "[[parameters('autoMitigate')]" }, - { - "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold", - "equals": "[[parameters('threshold')]" - }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator", "equals": "[[parameters('operator')]" @@ -253,7 +282,7 @@ }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods", - "equals": "1" + "equals": "[[parameters('evaluationPeriods')]" }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert", @@ -261,7 +290,11 @@ }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query", - "equals": "InsightsMetrics| where Origin == \"vm.azm.ms\"| where Namespace == \"Processor\" and Name == \"UtilizationPercentage\"| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId" + "equals": "[[format('let policyThresholdString = \"{2}\"; let excludedResources = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\"{1}\")); let excludedVMSSNodes = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | project _ResourceId = tolower(id), tags | where tags contains \"_amba-UtilizationPercentage-threshold-override_\"); InsightsMetrics | where _ResourceId has \"Microsoft.Compute/virtualMachines\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \"vm.azm.ms\" | where Namespace == \"Processor\" and Name == \"UtilizationPercentage\" | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \"_amba-UtilizationPercentage-threshold-override_\", tostring(tags.[\"_amba-UtilizationPercentage-threshold-override_\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'), parameters('threshold'))]" + }, + { + "field": "identity.userAssignedIdentities", + "containsKey": "[[parameters('UAMIResourceId')]" } ] }, @@ -282,6 +315,9 @@ "alertResourceGroupLocation": { "type": "string" }, + "UAMIResourceId": { + "type": "string" + }, "severity": { "type": "String" }, @@ -314,6 +350,15 @@ }, "failingPeriods": { "type": "String" + }, + "evaluationPeriods": { + "type": "String" + }, + "MonitorDisableTagName": { + "type": "String" + }, + "MonitorDisableTagValues": { + "type": "Array" } }, "variables": {}, @@ -347,6 +392,9 @@ }, "alertResourceGroupLocation": { "type": "string" + }, + "UAMIResourceId": { + "type": "string" } }, "variables": {}, @@ -356,6 +404,12 @@ "apiVersion": "2022-08-01-preview", "name": "[[concat(subscription().displayName, '-VMHighCPUAlert')]", "location": "[[parameters('alertResourceGroupLocation')]", + "identity": { + "type": "UserAssigned", + "userAssignedIdentities": { + "[[parameters('UAMIResourceId')]": {} + } + }, "tags": { "_deployed_by_amba": true }, @@ -375,9 +429,8 @@ "criteria": { "allOf": [ { - "query": "InsightsMetrics| where Origin == \"vm.azm.ms\"| where Namespace == \"Processor\" and Name == \"UtilizationPercentage\"| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId", - "metricMeasureColumn": "AggregatedValue", - "threshold": "[[parameters('threshold')]", + "query": "[[format('let policyThresholdString = \"{2}\"; let excludedResources = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\"{1}\")); let excludedVMSSNodes = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | project _ResourceId = tolower(id), tags | where tags contains \"_amba-UtilizationPercentage-threshold-override_\"); InsightsMetrics | where _ResourceId has \"Microsoft.Compute/virtualMachines\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \"vm.azm.ms\" | where Namespace == \"Processor\" and Name == \"UtilizationPercentage\" | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \"_amba-UtilizationPercentage-threshold-override_\", tostring(tags.[\"_amba-UtilizationPercentage-threshold-override_\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'), parameters('threshold'))]", + "threshold": 0, "operator": "[[parameters('operator')]", "resourceIdColumn": "_ResourceId", "timeAggregation": "[[parameters('timeAggregation')]", @@ -391,7 +444,7 @@ } ], "failingPeriods": { - "numberOfEvaluationPeriods": "1", + "numberOfEvaluationPeriods": "[[parameters('evaluationPeriods')]", "minFailingPeriodsToAlert": "[[parameters('failingPeriods')]" } } @@ -409,6 +462,9 @@ "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" + }, "severity": { "value": "[[parameters('severity')]" }, @@ -435,6 +491,15 @@ }, "failingPeriods": { "value": "[[parameters('failingPeriods')]" + }, + "evaluationPeriods": { + "value": "[[parameters('evaluationPeriods')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('MonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('MonitorDisableTagValues')]" } } } @@ -450,6 +515,9 @@ }, "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" + }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" } } } @@ -466,6 +534,9 @@ "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" + }, "severity": { "value": "[[parameters('severity')]" }, @@ -498,6 +569,15 @@ }, "failingPeriods": { "value": "[[parameters('failingPeriods')]" + }, + "evaluationPeriods": { + "value": "[[parameters('evaluationPeriods')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('MonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('MonitorDisableTagValues')]" } } } diff --git a/services/Compute/virtualMachines/Deploy-VM-PercentMemory-Alert.json b/services/Compute/virtualMachines/Deploy-VM-PercentMemory-Alert.json index 710a8534a..71ca4e0a3 100644 --- a/services/Compute/virtualMachines/Deploy-VM-PercentMemory-Alert.json +++ b/services/Compute/virtualMachines/Deploy-VM-PercentMemory-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy VM Memory Alert", "description": "Policy to audit/deploy VM Memory Alert", "metadata": { - "version": "1.2.0", + "version": "1.4.0", "category": "Compute", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -23,7 +23,7 @@ "displayName": "Resource Group Name", "description": "Resource group the alert is placed in" }, - "defaultValue": "AlzMonitoring-rg" + "defaultValue": "rg-amba-monitoring-001" }, "alertResourceGroupTags": { "type": "Object", @@ -32,7 +32,7 @@ "description": "Tags on the Resource group the alert is placed in" }, "defaultValue": { - "environment": "test" + "Project": "amba-monitoring" } }, "alertResourceGroupLocation": { @@ -43,6 +43,14 @@ }, "defaultValue": "centralus" }, + "UAMIResourceId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "The resource Id of the user assigned managed identity.", + "displayName": "User Assigned managed Identity resource Id." + } + }, "severity": { "type": "String", "metadata": { @@ -64,13 +72,9 @@ "displayName": "Operator" }, "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" + "GreaterThan" ], - "defaultValue": "LessThan" + "defaultValue": "GreaterThan" }, "timeAggregation": { "type": "String", @@ -78,13 +82,9 @@ "displayName": "TimeAggregation" }, "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" + "Count" ], - "defaultValue": "Average" + "defaultValue": "Count" }, "windowSize": { "type": "String", @@ -196,6 +196,27 @@ "disabled" ], "defaultValue": "deployIfNotExists" + }, + "MonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name to disable monitoring. Set to true if monitoring should be disabled" + }, + "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -204,6 +225,10 @@ { "field": "type", "equals": "Microsoft.Compute/virtualMachines" + }, + { + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -214,7 +239,7 @@ "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c" ], "type": "Microsoft.Insights/scheduledQueryRules", - "existenceScope": "resourcegroup", + "existenceScope": "resourceGroup", "resourceGroupName": "[[parameters('alertResourceGroupName')]", "deploymentScope": "subscription", "existenceCondition": { @@ -224,33 +249,29 @@ "equals": "[[concat(subscription().displayName, '-VMLowMemoryAlert')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/scopes[*]", + "field": "Microsoft.Insights/scheduledQueryRules/scopes[*]", "equals": "[[subscription().id]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/enabled", + "field": "Microsoft.Insights/scheduledQueryRules/enabled", "equals": "[[parameters('enabled')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/evaluationFrequency", + "field": "Microsoft.Insights/scheduledQueryRules/evaluationFrequency", "equals": "[[parameters('evaluationFrequency')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/windowSize", + "field": "Microsoft.Insights/scheduledQueryRules/windowSize", "equals": "[[parameters('windowSize')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/severity", + "field": "Microsoft.Insights/scheduledQueryRules/severity", "equals": "[[parameters('severity')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/autoMitigate", + "field": "Microsoft.Insights/scheduledQueryRules/autoMitigate", "equals": "[[parameters('autoMitigate')]" }, - { - "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold", - "equals": "[[parameters('threshold')]" - }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator", "equals": "[[parameters('operator')]" @@ -269,7 +290,11 @@ }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query", - "equals": "InsightsMetrics| where Origin == \"vm.azm.ms\"|where Namespace == \"Memory\" and Name == \"AvailableMB\"| extend TotalMemory = toreal(todynamic(Tags)[\"vm.azm.ms/memorySizeMB\"]) | extend AvailableMemoryPercentage = (toreal(Val) / TotalMemory) * 100.0| summarize AggregatedValue = avg(AvailableMemoryPercentage) by bin(TimeGenerated, 15m), Computer, _ResourceId" + "equals": "[[format('let policyThresholdString = \"{2}\"; let excludedResources = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\"{1}\")); let excludedVMSSNodes = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | project _ResourceId = tolower(id), tags | where tags contains \"_amba-AvailableMemoryPercentage-threshold-override_\"); InsightsMetrics | where _ResourceId has \"Microsoft.Compute/virtualMachines\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \"vm.azm.ms\" | where Namespace == \"Memory\" and Name == \"AvailableMB\" | extend TotalMemory = toreal(todynamic(Tags)[\"vm.azm.ms/memorySizeMB\"]) | extend AvailableMemoryPercentage = (toreal(Val) / TotalMemory) * 100.0 | summarize AggregatedValue = avg(AvailableMemoryPercentage) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \"_amba-AvailableMemoryPercentage-threshold-override_\", tostring(tags.[\"_amba-AvailableMemoryPercentage-threshold-override_\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'), parameters('threshold'))]" + }, + { + "field": "identity.userAssignedIdentities", + "containsKey": "[[parameters('UAMIResourceId')]" } ] }, @@ -290,6 +315,9 @@ "alertResourceGroupLocation": { "type": "string" }, + "UAMIResourceId": { + "type": "string" + }, "severity": { "type": "String" }, @@ -325,6 +353,12 @@ }, "evaluationPeriods": { "type": "String" + }, + "MonitorDisableTagName": { + "type": "String" + }, + "MonitorDisableTagValues": { + "type": "Array" } }, "variables": {}, @@ -358,6 +392,9 @@ }, "alertResourceGroupLocation": { "type": "string" + }, + "UAMIResourceId": { + "type": "string" } }, "variables": {}, @@ -367,6 +404,12 @@ "apiVersion": "2022-08-01-preview", "name": "[[concat(subscription().displayName, '-VMLowMemoryAlert')]", "location": "[[parameters('alertResourceGroupLocation')]", + "identity": { + "type": "UserAssigned", + "userAssignedIdentities": { + "[[parameters('UAMIResourceId')]": {} + } + }, "tags": { "_deployed_by_amba": true }, @@ -386,9 +429,8 @@ "criteria": { "allOf": [ { - "query": "InsightsMetrics| where Origin == \"vm.azm.ms\"|where Namespace == \"Memory\" and Name == \"AvailableMB\"| extend TotalMemory = toreal(todynamic(Tags)[\"vm.azm.ms/memorySizeMB\"]) | extend AvailableMemoryPercentage = (toreal(Val) / TotalMemory) * 100.0| summarize AggregatedValue = avg(AvailableMemoryPercentage) by bin(TimeGenerated, 15m), Computer, _ResourceId", - "metricMeasureColumn": "AggregatedValue", - "threshold": "[[parameters('threshold')]", + "query": "[[format('let policyThresholdString = \"{2}\"; let excludedResources = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\"{1}\")); let excludedVMSSNodes = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | extend isVMSS = isnotempty(properties.virtualMachineScaleSet) | where isVMSS | project id, name); let overridenResource = (arg(\"\").resources | where type =~ \"Microsoft.Compute/virtualMachines\" | project _ResourceId = tolower(id), tags | where tags contains \"_amba-AvailableMemoryPercentage-threshold-override_\"); InsightsMetrics | where _ResourceId has \"Microsoft.Compute/virtualMachines\" | where _ResourceId !in~ (excludedResources) | where _ResourceId !in~ (excludedVMSSNodes) | where Origin == \"vm.azm.ms\" | where Namespace == \"Memory\" and Name == \"AvailableMB\" | extend TotalMemory = toreal(todynamic(Tags)[\"vm.azm.ms/memorySizeMB\"]) | extend AvailableMemoryPercentage = (toreal(Val) / TotalMemory) * 100.0 | summarize AggregatedValue = avg(AvailableMemoryPercentage) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \"_amba-AvailableMemoryPercentage-threshold-override_\", tostring(tags.[\"_amba-AvailableMemoryPercentage-threshold-override_\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'), parameters('threshold'))]", + "threshold": 0, "operator": "[[parameters('operator')]", "resourceIdColumn": "_ResourceId", "timeAggregation": "[[parameters('timeAggregation')]", @@ -420,6 +462,9 @@ "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" + }, "severity": { "value": "[[parameters('severity')]" }, @@ -449,6 +494,12 @@ }, "evaluationPeriods": { "value": "[[parameters('evaluationPeriods')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('MonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('MonitorDisableTagValues')]" } } } @@ -464,6 +515,9 @@ }, "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" + }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" } } } @@ -480,6 +534,9 @@ "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" + }, "severity": { "value": "[[parameters('severity')]" }, @@ -515,6 +572,12 @@ }, "evaluationPeriods": { "value": "[[parameters('evaluationPeriods')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('MonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('MonitorDisableTagValues')]" } } } diff --git a/services/Compute/virtualMachines/alerts.yaml b/services/Compute/virtualMachines/alerts.yaml index 2d8d7e2c5..cb799ca0c 100644 --- a/services/Compute/virtualMachines/alerts.yaml +++ b/services/Compute/virtualMachines/alerts.yaml @@ -45,7 +45,7 @@ timeAggregation: Average windowSize: PT15M evaluationFrequency: PT5M - threshold: 30 + threshold: 25 metricMeasureColumn: AggregatedValue resouceIdColumn: _ResourceId dimensions: @@ -163,7 +163,7 @@ timeAggregation: Average windowSize: PT15M evaluationFrequency: PT5M - threshold: 30 + threshold: 25 metricMeasureColumn: AggregatedValue resouceIdColumn: _ResourceId dimensions: @@ -397,7 +397,7 @@ timeAggregation: Average windowSize: PT15M evaluationFrequency: PT5M - threshold: 30 + threshold: 25 metricMeasureColumn: AggregatedValue resouceIdColumn: _ResourceId dimensions: @@ -420,6 +420,8 @@ | extend Disk=tostring(todynamic(Tags)["vm.azm.ms/mountId"]) + | where Disk in (''C:'',''/'') + | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk @@ -477,6 +479,8 @@ | extend Disk=tostring(todynamic(Tags)["vm.azm.ms/mountId"]) + | where Disk in (''C:'',''/'') + | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk @@ -511,7 +515,7 @@ timeAggregation: Average windowSize: PT15M evaluationFrequency: PT5M - threshold: 50 + threshold: 25 metricMeasureColumn: AggregatedValue resouceIdColumn: _ResourceId dimensions: @@ -532,6 +536,8 @@ | extend Disk=tostring(todynamic(Tags)["vm.azm.ms/mountId"]) + | where Disk in (''C:'',''/'') + | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk diff --git a/services/HybridCompute/machines/Deploy-Hybrid-VM-DataDiskReadLatency-Alert.json b/services/HybridCompute/machines/Deploy-Hybrid-VM-DataDiskReadLatency-Alert.json index 7135d532f..922a2187a 100644 --- a/services/HybridCompute/machines/Deploy-Hybrid-VM-DataDiskReadLatency-Alert.json +++ b/services/HybridCompute/machines/Deploy-Hybrid-VM-DataDiskReadLatency-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy Hybrid VM Data Disk Read Latency Alert", "description": "Policy to audit/deploy VM dataDiskReadLatency Alert", "metadata": { - "version": "1.0.1", + "version": "1.2.0", "category": "Hybrid Compute", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -23,7 +23,7 @@ "displayName": "Resource Group Name", "description": "Resource group the alert is placed in" }, - "defaultValue": "AlzMonitoring-rg" + "defaultValue": "rg-amba-monitoring-001" }, "alertResourceGroupTags": { "type": "Object", @@ -32,7 +32,7 @@ "description": "Tags on the Resource group the alert is placed in" }, "defaultValue": { - "environment": "test" + "Project": "amba-monitoring" } }, "alertResourceGroupLocation": { @@ -43,6 +43,14 @@ }, "defaultValue": "centralus" }, + "UAMIResourceId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "The resource Id of the user assigned managed identity.", + "displayName": "User Assigned managed Identity resource Id." + } + }, "severity": { "type": "String", "metadata": { @@ -64,11 +72,7 @@ "displayName": "Operator" }, "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" + "GreaterThan" ], "defaultValue": "GreaterThan" }, @@ -78,13 +82,9 @@ "displayName": "TimeAggregation" }, "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" + "Count" ], - "defaultValue": "Average" + "defaultValue": "Count" }, "windowSize": { "type": "String", @@ -195,16 +195,6 @@ "*" ] }, - "disksToInclude": { - "type": "array", - "metadata": { - "displayName": "Disks to be included to be monitored", - "description": "Array of disk to be monitored for disk both windows and linux" - }, - "defaultValue": [ - "*" - ] - }, "effect": { "type": "String", "metadata": { @@ -216,6 +206,27 @@ "disabled" ], "defaultValue": "deployIfNotExists" + }, + "MonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name to disable monitoring. Set to true if monitoring should be disabled" + }, + "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -224,6 +235,10 @@ { "field": "type", "equals": "Microsoft.HybridCompute/machines" + }, + { + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -234,43 +249,39 @@ "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c" ], "type": "Microsoft.Insights/scheduledQueryRules", - "existenceScope": "resourcegroup", + "existenceScope": "resourceGroup", "resourceGroupName": "[[parameters('alertResourceGroupName')]", "deploymentScope": "subscription", "existenceCondition": { "allOf": [ { "field": "Microsoft.Insights/scheduledQueryRules/displayName", - "equals": "[[concat(subscription().displayName, '-HybridVMHighdataDiskReadLatencyAlert')]" + "equals": "[[concat(subscription().displayName, '-HybridVMHighDataDiskReadLatencyAlert')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/scopes[*]", + "field": "Microsoft.Insights/scheduledQueryRules/scopes[*]", "equals": "[[subscription().id]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/enabled", + "field": "Microsoft.Insights/scheduledQueryRules/enabled", "equals": "[[parameters('enabled')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/evaluationFrequency", + "field": "Microsoft.Insights/scheduledQueryRules/evaluationFrequency", "equals": "[[parameters('evaluationFrequency')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/windowSize", + "field": "Microsoft.Insights/scheduledQueryRules/windowSize", "equals": "[[parameters('windowSize')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/severity", + "field": "Microsoft.Insights/scheduledQueryRules/severity", "equals": "[[parameters('severity')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/autoMitigate", + "field": "Microsoft.Insights/scheduledQueryRules/autoMitigate", "equals": "[[parameters('autoMitigate')]" }, - { - "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold", - "equals": "[[parameters('threshold')]" - }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator", "equals": "[[parameters('operator')]" @@ -289,7 +300,11 @@ }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query", - "equals": "InsightsMetrics| where Origin == \"vm.azm.ms\"| where Namespace == \"LogicalDisk\" and Name == \"ReadLatencyMs\"| extend Disk=tostring(todynamic(Tags)[\"vm.azm.ms/mountId\"])|where Disk !in ('C:','/')| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk" + "equals": "[[format('let policyThresholdString = \"{2}\"; let excludedResources = (arg(\"\").resources | where type =~ \"Microsoft.HybridCompute/machines\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\"{1}\")); let overridenResource = (arg(\"\").resources | where type == \"microsoft.hybridcompute/machines\" | project _ResourceId = tolower(id), tags | where tags contains \"_amba-ReadLatencyMs-Data-threshold-override_\"); InsightsMetrics | where _ResourceId has \"Microsoft.HybridCompute/machines\" | where _ResourceId !in~ (excludedResources) | where Origin == \"vm.azm.ms\" | where Namespace == \"LogicalDisk\" and Name == \"ReadLatencyMs\" | extend Disk=tostring(todynamic(Tags)[\"vm.azm.ms/mountId\"]) | where Disk !in (\"C:\", \"/\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \"_amba-ReadLatencyMs-Data-threshold-override_\", tostring(tags.[\"_amba-ReadLatencyMs-Data-threshold-override_\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'), parameters('threshold'))]" + }, + { + "field": "identity.userAssignedIdentities", + "containsKey": "[[parameters('UAMIResourceId')]" } ] }, @@ -310,6 +325,9 @@ "alertResourceGroupLocation": { "type": "string" }, + "UAMIResourceId": { + "type": "string" + }, "severity": { "type": "String" }, @@ -346,11 +364,14 @@ "evaluationPeriods": { "type": "String" }, - "disksToInclude": { - "type": "array" - }, "computersToInclude": { "type": "array" + }, + "MonitorDisableTagName": { + "type": "String" + }, + "MonitorDisableTagValues": { + "type": "Array" } }, "variables": {}, @@ -365,7 +386,7 @@ { "type": "Microsoft.Resources/deployments", "apiVersion": "2019-10-01", - "name": "VMdataDiskReadLatencyAlert", + "name": "HybridVMdataDiskReadLatencyAlert", "resourceGroup": "[[parameters('alertResourceGroupName')]", "dependsOn": [ "[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]" @@ -384,6 +405,9 @@ }, "alertResourceGroupLocation": { "type": "string" + }, + "UAMIResourceId": { + "type": "string" } }, "variables": {}, @@ -391,13 +415,19 @@ { "type": "Microsoft.Insights/scheduledQueryRules", "apiVersion": "2022-08-01-preview", - "name": "[[concat(subscription().displayName, '-HybridVMHighdataDiskReadLatencyAlert')]", + "name": "[[concat(subscription().displayName, '-HybridVMHighDataDiskReadLatencyAlert')]", "location": "[[parameters('alertResourceGroupLocation')]", + "identity": { + "type": "UserAssigned", + "userAssignedIdentities": { + "[[parameters('UAMIResourceId')]": {} + } + }, "tags": { "_deployed_by_amba": true }, "properties": { - "displayName": "[[concat(subscription().displayName, '-HybridVMHighdataDiskReadLatencyAlert')]", + "displayName": "[[concat(subscription().displayName, '-HybridVMHighDataDiskReadLatencyAlert')]", "description": "Log Alert for Virtual Machine dataDiskReadLatency", "severity": "[[parameters('severity')]", "enabled": "[[parameters('enabled')]", @@ -412,9 +442,8 @@ "criteria": { "allOf": [ { - "query": "InsightsMetrics| where Origin == \"vm.azm.ms\"| where Namespace == \"LogicalDisk\" and Name == \"ReadLatencyMs\"| extend Disk=tostring(todynamic(Tags)[\"vm.azm.ms/mountId\"])|where Disk !in ('C:','/')| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk", - "metricMeasureColumn": "AggregatedValue", - "threshold": "[[parameters('threshold')]", + "query": "[[format('let policyThresholdString = \"{2}\"; let excludedResources = (arg(\"\").resources | where type =~ \"Microsoft.HybridCompute/machines\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\"{1}\")); let overridenResource = (arg(\"\").resources | where type == \"microsoft.hybridcompute/machines\" | project _ResourceId = tolower(id), tags | where tags contains \"_amba-ReadLatencyMs-Data-threshold-override_\"); InsightsMetrics | where _ResourceId has \"Microsoft.HybridCompute/machines\" | where _ResourceId !in~ (excludedResources) | where Origin == \"vm.azm.ms\" | where Namespace == \"LogicalDisk\" and Name == \"ReadLatencyMs\" | extend Disk=tostring(todynamic(Tags)[\"vm.azm.ms/mountId\"]) | where Disk !in (\"C:\", \"/\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \"_amba-ReadLatencyMs-Data-threshold-override_\", tostring(tags.[\"_amba-ReadLatencyMs-Data-threshold-override_\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'), parameters('threshold'))]", + "threshold": 0, "operator": "[[parameters('operator')]", "resourceIdColumn": "_ResourceId", "timeAggregation": "[[parameters('timeAggregation')]", @@ -427,7 +456,9 @@ { "name": "Disk", "operator": "Include", - "values": "[[parameters('disksToInclude')]" + "values": [ + "*" + ] } ], "failingPeriods": { @@ -449,6 +480,9 @@ "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" + }, "severity": { "value": "[[parameters('severity')]" }, @@ -479,11 +513,14 @@ "evaluationPeriods": { "value": "[[parameters('evaluationPeriods')]" }, - "disksToInclude": { - "value": "[[parameters('disksToInclude')]" - }, "computersToInclude": { "value": "[[parameters('computersToInclude')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('MonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('MonitorDisableTagValues')]" } } } @@ -499,6 +536,9 @@ }, "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" + }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" } } } @@ -515,6 +555,9 @@ "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" + }, "severity": { "value": "[[parameters('severity')]" }, @@ -551,11 +594,14 @@ "evaluationPeriods": { "value": "[[parameters('evaluationPeriods')]" }, - "disksToInclude": { - "value": "[[parameters('disksToInclude')]" - }, "computersToInclude": { "value": "[[parameters('computersToInclude')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('MonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('MonitorDisableTagValues')]" } } } diff --git a/services/HybridCompute/machines/Deploy-Hybrid-VM-DataDiskSpace-Alert.json b/services/HybridCompute/machines/Deploy-Hybrid-VM-DataDiskSpace-Alert.json index a1a0584f6..c6ae8aeeb 100644 --- a/services/HybridCompute/machines/Deploy-Hybrid-VM-DataDiskSpace-Alert.json +++ b/services/HybridCompute/machines/Deploy-Hybrid-VM-DataDiskSpace-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy Hybrid VM Data Disk Space Alert", "description": "Policy to audit/deploy VM data Disk Space Alert", "metadata": { - "version": "1.0.1", + "version": "1.2.0", "category": "Hybrid Compute", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -23,7 +23,7 @@ "displayName": "Resource Group Name", "description": "Resource group the alert is placed in" }, - "defaultValue": "AlzMonitoring-rg" + "defaultValue": "rg-amba-monitoring-001" }, "alertResourceGroupTags": { "type": "Object", @@ -32,7 +32,7 @@ "description": "Tags on the Resource group the alert is placed in" }, "defaultValue": { - "environment": "test" + "Project": "amba-monitoring" } }, "alertResourceGroupLocation": { @@ -43,6 +43,14 @@ }, "defaultValue": "centralus" }, + "UAMIResourceId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "The resource Id of the user assigned managed identity.", + "displayName": "User Assigned managed Identity resource Id." + } + }, "severity": { "type": "String", "metadata": { @@ -64,13 +72,9 @@ "displayName": "Operator" }, "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" + "GreaterThan" ], - "defaultValue": "LessThan" + "defaultValue": "GreaterThan" }, "timeAggregation": { "type": "String", @@ -78,13 +82,9 @@ "displayName": "TimeAggregation" }, "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" + "Count" ], - "defaultValue": "Average" + "defaultValue": "Count" }, "windowSize": { "type": "String", @@ -185,6 +185,16 @@ }, "defaultValue": "1" }, + "computersToInclude": { + "type": "array", + "metadata": { + "displayName": "Computers to be included to be monitored", + "description": "Array of Computer to be monitored" + }, + "defaultValue": [ + "*" + ] + }, "effect": { "type": "String", "metadata": { @@ -197,14 +207,25 @@ ], "defaultValue": "deployIfNotExists" }, - "disksToInclude": { - "type": "array", + "MonitorDisableTagName": { + "type": "String", "metadata": { - "displayName": "Disks to be included to be monitored", - "description": "Array of disk to be monitored for disk both Windows and Linux" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name to disable monitoring. Set to true if monitoring should be disabled" + }, + "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": [ - "*" + "true", + "Test", + "Dev", + "Sandbox" ] } }, @@ -214,6 +235,10 @@ { "field": "type", "equals": "Microsoft.HybridCompute/machines" + }, + { + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -224,43 +249,39 @@ "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c" ], "type": "Microsoft.Insights/scheduledQueryRules", - "existenceScope": "resourcegroup", + "existenceScope": "resourceGroup", "resourceGroupName": "[[parameters('alertResourceGroupName')]", "deploymentScope": "subscription", "existenceCondition": { "allOf": [ { "field": "Microsoft.Insights/scheduledQueryRules/displayName", - "equals": "[[concat(subscription().displayName, '-HybridVMLowdataDiskSpaceAlert')]" + "equals": "[[concat(subscription().displayName, '-HybridVMLowDataDiskSpaceAlert')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/scopes[*]", + "field": "Microsoft.Insights/scheduledQueryRules/scopes[*]", "equals": "[[subscription().id]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/enabled", + "field": "Microsoft.Insights/scheduledQueryRules/enabled", "equals": "[[parameters('enabled')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/evaluationFrequency", + "field": "Microsoft.Insights/scheduledQueryRules/evaluationFrequency", "equals": "[[parameters('evaluationFrequency')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/windowSize", + "field": "Microsoft.Insights/scheduledQueryRules/windowSize", "equals": "[[parameters('windowSize')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/severity", + "field": "Microsoft.Insights/scheduledQueryRules/severity", "equals": "[[parameters('severity')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/autoMitigate", + "field": "Microsoft.Insights/scheduledQueryRules/autoMitigate", "equals": "[[parameters('autoMitigate')]" }, - { - "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold", - "equals": "[[parameters('threshold')]" - }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator", "equals": "[[parameters('operator')]" @@ -279,7 +300,11 @@ }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query", - "equals": "InsightsMetrics| where Origin == \"vm.azm.ms\"| where Namespace == \"LogicalDisk\" and Name == \"FreeSpacePercentage\"| extend Disk=tostring(todynamic(Tags)[\"vm.azm.ms/mountId\"])|where Disk !in ('C:','/')| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk" + "equals": "[[format('let policyThresholdString = \"{2}\"; let excludedResources = (arg(\"\").resources | where type =~ \"Microsoft.HybridCompute/machines\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\"{1}\")); let overridenResource = (arg(\"\").resources | where type == \"microsoft.hybridcompute/machines\" | project _ResourceId = tolower(id), tags | where tags contains \"_amba-FreeSpacePercentage-Data-threshold-override_\"); InsightsMetrics | where _ResourceId has \"Microsoft.HybridCompute/machines\" | where _ResourceId !in~ (excludedResources) | where Origin == \"vm.azm.ms\" | where Namespace == \"LogicalDisk\" and Name == \"FreeSpacePercentage\" | extend Disk=tostring(todynamic(Tags)[\"vm.azm.ms/mountId\"]) | where Disk !in (\"C:\",\"/\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \"_amba-FreeSpacePercentage-Data-threshold-override_\", tostring(tags.[\"_amba-FreeSpacePercentage-Data-threshold-override_\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'), parameters('threshold'))]" + }, + { + "field": "identity.userAssignedIdentities", + "containsKey": "[[parameters('UAMIResourceId')]" } ] }, @@ -300,6 +325,9 @@ "alertResourceGroupLocation": { "type": "string" }, + "UAMIResourceId": { + "type": "string" + }, "severity": { "type": "String" }, @@ -336,8 +364,14 @@ "evaluationPeriods": { "type": "String" }, - "disksToInclude": { + "computersToInclude": { "type": "array" + }, + "MonitorDisableTagName": { + "type": "String" + }, + "MonitorDisableTagValues": { + "type": "Array" } }, "variables": {}, @@ -352,7 +386,7 @@ { "type": "Microsoft.Resources/deployments", "apiVersion": "2019-10-01", - "name": "VMdataDiskSpaceAlert", + "name": "HybridVMdataDiskSpaceAlert", "resourceGroup": "[[parameters('alertResourceGroupName')]", "dependsOn": [ "[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]" @@ -371,6 +405,9 @@ }, "alertResourceGroupLocation": { "type": "string" + }, + "UAMIResourceId": { + "type": "string" } }, "variables": {}, @@ -378,13 +415,19 @@ { "type": "Microsoft.Insights/scheduledQueryRules", "apiVersion": "2022-08-01-preview", - "name": "[[concat(subscription().displayName, '-HybridVMLowdataDiskSpaceAlert')]", + "name": "[[concat(subscription().displayName, '-HybridVMLowDataDiskSpaceAlert')]", "location": "[[parameters('alertResourceGroupLocation')]", + "identity": { + "type": "UserAssigned", + "userAssignedIdentities": { + "[[parameters('UAMIResourceId')]": {} + } + }, "tags": { "_deployed_by_amba": true }, "properties": { - "displayName": "[[concat(subscription().displayName, '-HybridVMLowdataDiskSpaceAlert')]", + "displayName": "[[concat(subscription().displayName, '-HybridVMLowDataDiskSpaceAlert')]", "description": "Log Alert for Virtual Machine dataDiskSpace", "severity": "[[parameters('severity')]", "enabled": "[[parameters('enabled')]", @@ -399,9 +442,8 @@ "criteria": { "allOf": [ { - "query": "InsightsMetrics| where Origin == \"vm.azm.ms\"| where Namespace == \"LogicalDisk\" and Name == \"FreeSpacePercentage\"| extend Disk=tostring(todynamic(Tags)[\"vm.azm.ms/mountId\"])|where Disk !in ('C:','/')| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk", - "metricMeasureColumn": "AggregatedValue", - "threshold": "[[parameters('threshold')]", + "query": "[[format('let policyThresholdString = \"{2}\"; let excludedResources = (arg(\"\").resources | where type =~ \"Microsoft.HybridCompute/machines\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\"{1}\")); let overridenResource = (arg(\"\").resources | where type == \"microsoft.hybridcompute/machines\" | project _ResourceId = tolower(id), tags | where tags contains \"_amba-FreeSpacePercentage-Data-threshold-override_\"); InsightsMetrics | where _ResourceId has \"Microsoft.HybridCompute/machines\" | where _ResourceId !in~ (excludedResources) | where Origin == \"vm.azm.ms\" | where Namespace == \"LogicalDisk\" and Name == \"FreeSpacePercentage\" | extend Disk=tostring(todynamic(Tags)[\"vm.azm.ms/mountId\"]) | where Disk !in (\"C:\",\"/\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \"_amba-FreeSpacePercentage-Data-threshold-override_\", tostring(tags.[\"_amba-FreeSpacePercentage-Data-threshold-override_\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'), parameters('threshold'))]", + "threshold": 0, "operator": "[[parameters('operator')]", "resourceIdColumn": "_ResourceId", "timeAggregation": "[[parameters('timeAggregation')]", @@ -409,14 +451,14 @@ { "name": "Computer", "operator": "Include", - "values": [ - "*" - ] + "values": "[[parameters('computersToInclude')]" }, { "name": "Disk", "operator": "Include", - "values": "[[parameters('disksToInclude')]" + "values": [ + "*" + ] } ], "failingPeriods": { @@ -438,6 +480,9 @@ "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" + }, "severity": { "value": "[[parameters('severity')]" }, @@ -468,8 +513,14 @@ "evaluationPeriods": { "value": "[[parameters('evaluationPeriods')]" }, - "disksToInclude": { - "value": "[[parameters('disksToInclude')]" + "computersToInclude": { + "value": "[[parameters('computersToInclude')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('MonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('MonitorDisableTagValues')]" } } } @@ -485,6 +536,9 @@ }, "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" + }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" } } } @@ -501,6 +555,9 @@ "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" + }, "severity": { "value": "[[parameters('severity')]" }, @@ -537,8 +594,14 @@ "evaluationPeriods": { "value": "[[parameters('evaluationPeriods')]" }, - "disksToInclude": { - "value": "[[parameters('disksToInclude')]" + "computersToInclude": { + "value": "[[parameters('computersToInclude')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('MonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('MonitorDisableTagValues')]" } } } diff --git a/services/HybridCompute/machines/Deploy-Hybrid-VM-DataDiskWriteLatency-Alert.json b/services/HybridCompute/machines/Deploy-Hybrid-VM-DataDiskWriteLatency-Alert.json index 240951c14..ee0997574 100644 --- a/services/HybridCompute/machines/Deploy-Hybrid-VM-DataDiskWriteLatency-Alert.json +++ b/services/HybridCompute/machines/Deploy-Hybrid-VM-DataDiskWriteLatency-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy Hybrid VM Data Disk Write Latency Alert", "description": "Policy to audit/deploy VM dataDiskWriteLatency Alert", "metadata": { - "version": "1.0.1", + "version": "1.2.0", "category": "Hybrid Compute", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -23,7 +23,7 @@ "displayName": "Resource Group Name", "description": "Resource group the alert is placed in" }, - "defaultValue": "AlzMonitoring-rg" + "defaultValue": "rg-amba-monitoring-001" }, "alertResourceGroupTags": { "type": "Object", @@ -32,7 +32,7 @@ "description": "Tags on the Resource group the alert is placed in" }, "defaultValue": { - "environment": "test" + "Project": "amba-monitoring" } }, "alertResourceGroupLocation": { @@ -43,6 +43,14 @@ }, "defaultValue": "centralus" }, + "UAMIResourceId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "The resource Id of the user assigned managed identity.", + "displayName": "User Assigned managed Identity resource Id." + } + }, "severity": { "type": "String", "metadata": { @@ -64,11 +72,7 @@ "displayName": "Operator" }, "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" + "GreaterThan" ], "defaultValue": "GreaterThan" }, @@ -78,13 +82,9 @@ "displayName": "TimeAggregation" }, "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" + "Count" ], - "defaultValue": "Average" + "defaultValue": "Count" }, "windowSize": { "type": "String", @@ -195,16 +195,6 @@ "*" ] }, - "disksToInclude": { - "type": "array", - "metadata": { - "displayName": "Disks to be included to be monitored", - "description": "Array of disk to be monitored for disk both windows and linux" - }, - "defaultValue": [ - "*" - ] - }, "effect": { "type": "String", "metadata": { @@ -216,6 +206,27 @@ "disabled" ], "defaultValue": "deployIfNotExists" + }, + "MonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name to disable monitoring. Set to true if monitoring should be disabled" + }, + "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -224,6 +235,10 @@ { "field": "type", "equals": "Microsoft.HybridCompute/machines" + }, + { + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -234,43 +249,39 @@ "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c" ], "type": "Microsoft.Insights/scheduledQueryRules", - "existenceScope": "resourcegroup", + "existenceScope": "resourceGroup", "resourceGroupName": "[[parameters('alertResourceGroupName')]", "deploymentScope": "subscription", "existenceCondition": { "allOf": [ { "field": "Microsoft.Insights/scheduledQueryRules/displayName", - "equals": "[[concat(subscription().displayName, '-HybridVMHighdataDiskWriteLatencyAlert')]" + "equals": "[[concat(subscription().displayName, '-HybridVMHighDataDiskWriteLatencyAlert')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/scopes[*]", + "field": "Microsoft.Insights/scheduledQueryRules/scopes[*]", "equals": "[[subscription().id]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/enabled", + "field": "Microsoft.Insights/scheduledQueryRules/enabled", "equals": "[[parameters('enabled')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/evaluationFrequency", + "field": "Microsoft.Insights/scheduledQueryRules/evaluationFrequency", "equals": "[[parameters('evaluationFrequency')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/windowSize", + "field": "Microsoft.Insights/scheduledQueryRules/windowSize", "equals": "[[parameters('windowSize')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/severity", + "field": "Microsoft.Insights/scheduledQueryRules/severity", "equals": "[[parameters('severity')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/autoMitigate", + "field": "Microsoft.Insights/scheduledQueryRules/autoMitigate", "equals": "[[parameters('autoMitigate')]" }, - { - "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold", - "equals": "[[parameters('threshold')]" - }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator", "equals": "[[parameters('operator')]" @@ -289,7 +300,11 @@ }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query", - "equals": "InsightsMetrics| where Origin == \"vm.azm.ms\"| where Namespace == \"LogicalDisk\" and Name == \"WriteLatencyMs\"| extend Disk=tostring(todynamic(Tags)[\"vm.azm.ms/mountId\"])|where Disk !in ('C:','/')| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk" + "equals": "[[format('let policyThresholdString = \"{2}\"; let excludedResources = (arg(\"\").resources | where type =~ \"Microsoft.HybridCompute/machines\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\"{1}\")); let overridenResource = (arg(\"\").resources | where type == \"microsoft.hybridcompute/machines\" | project _ResourceId = tolower(id), tags | where tags contains \"_amba-WriteLatencyMs-Data-threshold-override_\"); InsightsMetrics | where _ResourceId has \"Microsoft.HybridCompute/machines\" | where _ResourceId !in~ (excludedResources) | where Origin == \"vm.azm.ms\" | where Namespace == \"LogicalDisk\" and Name == \"WriteLatencyMs\" | extend Disk=tostring(todynamic(Tags)[\"vm.azm.ms/mountId\"]) | where Disk !in (\"C:\",\"/\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \"_amba-WriteLatencyMs-Data-threshold-override_\", tostring(tags.[\"_amba-WriteLatencyMs-Data-threshold-override_\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'), parameters('threshold'))]" + }, + { + "field": "identity.userAssignedIdentities", + "containsKey": "[[parameters('UAMIResourceId')]" } ] }, @@ -310,6 +325,9 @@ "alertResourceGroupLocation": { "type": "string" }, + "UAMIResourceId": { + "type": "string" + }, "severity": { "type": "String" }, @@ -346,11 +364,14 @@ "evaluationPeriods": { "type": "String" }, - "disksToInclude": { - "type": "array" - }, "computersToInclude": { "type": "array" + }, + "MonitorDisableTagName": { + "type": "String" + }, + "MonitorDisableTagValues": { + "type": "Array" } }, "variables": {}, @@ -365,7 +386,7 @@ { "type": "Microsoft.Resources/deployments", "apiVersion": "2019-10-01", - "name": "VMdataDiskWriteLatencyAlert", + "name": "HybridVMdataDiskWriteLatencyAlert", "resourceGroup": "[[parameters('alertResourceGroupName')]", "dependsOn": [ "[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]" @@ -384,6 +405,9 @@ }, "alertResourceGroupLocation": { "type": "string" + }, + "UAMIResourceId": { + "type": "string" } }, "variables": {}, @@ -391,13 +415,19 @@ { "type": "Microsoft.Insights/scheduledQueryRules", "apiVersion": "2022-08-01-preview", - "name": "[[concat(subscription().displayName, '-HybridVMHighdataDiskWriteLatencyAlert')]", + "name": "[[concat(subscription().displayName, '-HybridVMHighDataDiskWriteLatencyAlert')]", "location": "[[parameters('alertResourceGroupLocation')]", + "identity": { + "type": "UserAssigned", + "userAssignedIdentities": { + "[[parameters('UAMIResourceId')]": {} + } + }, "tags": { "_deployed_by_amba": true }, "properties": { - "displayName": "[[concat(subscription().displayName, '-HybridVMHighdataDiskWriteLatencyAlert')]", + "displayName": "[[concat(subscription().displayName, '-HybridVMHighDataDiskWriteLatencyAlert')]", "description": "Log Alert for Virtual Machine dataDiskWriteLatency", "severity": "[[parameters('severity')]", "enabled": "[[parameters('enabled')]", @@ -405,7 +435,6 @@ "[[subscription().Id]" ], "targetResourceTypes": [ - "Microsoft.HybridCompute/machines", "Microsoft.HybridCompute/machines" ], "evaluationFrequency": "[[parameters('evaluationFrequency')]", @@ -413,9 +442,8 @@ "criteria": { "allOf": [ { - "query": "InsightsMetrics| where Origin == \"vm.azm.ms\"| where Namespace == \"LogicalDisk\" and Name == \"WriteLatencyMs\"| extend Disk=tostring(todynamic(Tags)[\"vm.azm.ms/mountId\"])|where Disk !in ('C:','/')| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk", - "metricMeasureColumn": "AggregatedValue", - "threshold": "[[parameters('threshold')]", + "query": "[[format('let policyThresholdString = \"{2}\"; let excludedResources = (arg(\"\").resources | where type =~ \"Microsoft.HybridCompute/machines\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\"{1}\")); let overridenResource = (arg(\"\").resources | where type == \"microsoft.hybridcompute/machines\" | project _ResourceId = tolower(id), tags | where tags contains \"_amba-WriteLatencyMs-Data-threshold-override_\"); InsightsMetrics | where _ResourceId has \"Microsoft.HybridCompute/machines\" | where _ResourceId !in~ (excludedResources) | where Origin == \"vm.azm.ms\" | where Namespace == \"LogicalDisk\" and Name == \"WriteLatencyMs\" | extend Disk=tostring(todynamic(Tags)[\"vm.azm.ms/mountId\"]) | where Disk !in (\"C:\",\"/\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \"_amba-WriteLatencyMs-Data-threshold-override_\", tostring(tags.[\"_amba-WriteLatencyMs-Data-threshold-override_\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'), parameters('threshold'))]", + "threshold": 0, "operator": "[[parameters('operator')]", "resourceIdColumn": "_ResourceId", "timeAggregation": "[[parameters('timeAggregation')]", @@ -428,7 +456,9 @@ { "name": "Disk", "operator": "Include", - "values": "[[parameters('disksToInclude')]" + "values": [ + "*" + ] } ], "failingPeriods": { @@ -450,6 +480,9 @@ "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" + }, "severity": { "value": "[[parameters('severity')]" }, @@ -480,11 +513,14 @@ "evaluationPeriods": { "value": "[[parameters('evaluationPeriods')]" }, - "disksToInclude": { - "value": "[[parameters('disksToInclude')]" - }, "computersToInclude": { "value": "[[parameters('computersToInclude')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('MonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('MonitorDisableTagValues')]" } } } @@ -500,6 +536,9 @@ }, "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" + }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" } } } @@ -516,6 +555,9 @@ "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" + }, "severity": { "value": "[[parameters('severity')]" }, @@ -552,11 +594,14 @@ "evaluationPeriods": { "value": "[[parameters('evaluationPeriods')]" }, - "disksToInclude": { - "value": "[[parameters('disksToInclude')]" - }, "computersToInclude": { "value": "[[parameters('computersToInclude')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('MonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('MonitorDisableTagValues')]" } } } diff --git a/services/HybridCompute/machines/Deploy-Hybrid-VM-Disconnected-Alert.json b/services/HybridCompute/machines/Deploy-Hybrid-VM-Disconnected-Alert.json index d1d449c10..2ddfed84e 100644 --- a/services/HybridCompute/machines/Deploy-Hybrid-VM-Disconnected-Alert.json +++ b/services/HybridCompute/machines/Deploy-Hybrid-VM-Disconnected-Alert.json @@ -1,5 +1,5 @@ { - "type": "Microsoft.Authorization/policyDefinitions", + "type": "Microsoft.Authorization/policyDefinitions", "apiVersion": "2021-06-01", "name": "Deploy_Hybrid_VM_Disconnected_Alert", "properties": { @@ -8,7 +8,7 @@ "displayName": "Deploy Hybrid VM Disconnected Alert", "description": "Policy to Deploy Hybrid VM Disconnected Alert", "metadata": { - "version": "1.0.0", + "version": "1.2.0", "category": "Hybrid Compute", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -41,30 +41,15 @@ "displayName": "Resource Group Location", "description": "Location of the Resource group the alert is placed in" }, - "defaultValue": "eastus" + "defaultValue": "centralus" }, - "userAssignedManagedIdentityName": { - "type": "string", - "defaultValue": "id-AMBA-ARG-Reader-001", - "metadata": { - "description": "The name of the user assigned managed identity to be created for monitoring purpose.", - "displayName": "Name of the user assigned managed identity to be created." - } - }, - "managementSubscriptionId": { - "type": "string", - "defaultValue": "", - "metadata": { - "description": "The subscription ID of the management subscription where the user assigned managed identity will be created." - } - }, - "BYOUserAssignedManagedIdentityResourceId": { - "type": "string", - "defaultValue": "", - "metadata": { - "description": "The resource Id of the user assigned managed identity provided by the customer.", - "displayName": "Customer defined User Assigned managed Identity resource Id." - } + "UAMIResourceId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "The resource Id of the user assigned managed identity.", + "displayName": "User Assigned managed Identity resource Id." + } }, "severity": { "type": "String", @@ -87,11 +72,7 @@ "displayName": "Operator" }, "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" + "GreaterThan" ], "defaultValue": "GreaterThan" }, @@ -101,10 +82,6 @@ "displayName": "TimeAggregation" }, "allowedValues": [ - "Average", - "Maximum", - "Minimum", - "Total", "Count" ], "defaultValue": "Count" @@ -128,10 +105,17 @@ "description": "Evaluation frequency for the alert" }, "allowedValues": [ + "PT5M", + "PT10M", + "PT15M", + "PT30M", + "PT1H", + "PT2H", + "PT6H", "PT12H", "P1D" ], - "defaultValue": "P1D" + "defaultValue": "PT10M" }, "autoMitigate": { "type": "String", @@ -159,11 +143,26 @@ }, "threshold": { "type": "String", + "defaultValue": "10m", + "allowedValues": [ + "5m", + "10m", + "15m", + "30m", + "1h", + "2h", + "3h", + "6h", + "12h", + "1d", + "2d", + "3d", + "7d" + ], "metadata": { - "displayName": "Threshold", - "description": "Threshold for the alert" - }, - "defaultValue": "0" + "displayName": "Hybrid VM Disconnected Threshold (expressed in timespan)", + "description": "Threshold in timespan value for the Hybrid VM Disconnected alert" + } }, "failingPeriods": { "type": "String", @@ -192,6 +191,27 @@ "disabled" ], "defaultValue": "deployIfNotExists" + }, + "MonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name to disable monitoring. Set to true if monitoring should be disabled" + }, + "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -199,7 +219,11 @@ "allOf": [ { "field": "type", - "equals": "microsoft.hybridcompute/machines" + "equals": "Microsoft.HybridCompute/machines" + }, + { + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -217,7 +241,7 @@ "allOf": [ { "field": "Microsoft.Insights/scheduledQueryRules/displayName", - "equals": "[[concat(subscription().displayName, '-HybridVMDisconnected')]" + "equals": "[[concat(subscription().displayName, '-HybridVMDisconnectedAlert')]" }, { "field": "Microsoft.Insights/scheduledQueryRules/scopes[*]", @@ -243,10 +267,6 @@ "field": "Microsoft.Insights/scheduledQueryRules/autoMitigate", "equals": "[[parameters('autoMitigate')]" }, - { - "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold", - "equals": 0 - }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator", "equals": "[[parameters('operator')]" @@ -265,7 +285,11 @@ }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query", - "equals": "[[format('arg(\"\").resources | where type == \"microsoft.hybridcompute/machines\" | where tostring(properties.status) == \"Disconnected\" | extend lastContactedDate = todatetime(properties.lastStatusChange) | where lastContactedDate <= ago({0}d) | extend status = tostring(properties.status) | project id, Computer=name, status, lastContactedDate', parameters('threshold'))]" + "equals": "[[format('let policyThresholdString = \"{2}\"; arg(\"\").resources | where type == \"microsoft.hybridcompute/machines\" | where parse_json(tostring(tags.{0})) !in~ (\"{1}\") | where tostring(properties.status) == \"Disconnected\" | extend appliedThresholdString = iif(tags contains \"_amba-Disconnected-threshold-override_\", tostring(tags.[\"_amba-Disconnected-threshold-override_\"]), policyThresholdString) | extend appliedThreshold = totimespan(appliedThresholdString) | extend lastContactedDate = todatetime(properties.lastStatusChange) | where lastContactedDate >= ago(appliedThreshold) | extend status = tostring(properties.status) | project id, Computer=name, status, lastContactedDate', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'), parameters('threshold'))]" + }, + { + "field": "identity.userAssignedIdentities", + "containsKey": "[[parameters('UAMIResourceId')]" } ] }, @@ -286,13 +310,7 @@ "alertResourceGroupLocation": { "type": "string" }, - "userAssignedManagedIdentityName": { - "type": "string" - }, - "managementSubscriptionId": { - "type": "string" - }, - "BYOUserAssignedManagedIdentityResourceId": { + "UAMIResourceId": { "type": "string" }, "severity": { @@ -324,11 +342,15 @@ }, "evaluationPeriods": { "type": "String" + }, + "MonitorDisableTagName": { + "type": "String" + }, + "MonitorDisableTagValues": { + "type": "Array" } }, - "variables": { - "uamiResourceId": "[[if(empty(parameters('BYOUserAssignedManagedIdentityResourceId')), resourceId(parameters('managementSubscriptionId'), parameters('alertResourceGroupName'), 'Microsoft.ManagedIdentity/userAssignedIdentities', parameters('userAssignedManagedIdentityName')),parameters('BYOUserAssignedManagedIdentityResourceId'))]" - }, + "variables": {}, "resources": [ { "type": "Microsoft.Resources/resourceGroups", @@ -359,13 +381,8 @@ }, "alertResourceGroupLocation": { "type": "string" - },"userAssignedManagedIdentityName": { - "type": "string" }, - "managementSubscriptionId": { - "type": "string" - }, - "BYOUserAssignedManagedIdentityResourceId": { + "UAMIResourceId": { "type": "string" } }, @@ -374,19 +391,19 @@ { "type": "Microsoft.Insights/scheduledQueryRules", "apiVersion": "2022-08-01-preview", - "name": "[[concat(subscription().displayName, '-HybridVMDisconnected')]", + "name": "[[concat(subscription().displayName, '-HybridVMDisconnectedAlert')]", "location": "[[parameters('alertResourceGroupLocation')]", "identity": { "type": "UserAssigned", "userAssignedIdentities": { - "[[variables('uamiResourceId')]": {} + "[[parameters('UAMIResourceId')]": {} } }, "tags": { "_deployed_by_amba": true }, "properties": { - "displayName": "[[concat(subscription().displayName, '-HybridVMDisconnected')]", + "displayName": "[[concat(subscription().displayName, '-HybridVMDisconnectedAlert')]", "description": "Hybrid VM in disconnected state. Not being connected, prevents extensions to be correctly managed from the portal and Azure policies to be correctly applied. Ensure that both server the specific service (Azure Hybrid Instance Metadata Service on Windows or azcmagent on Linux) are running.", "severity": "[[parameters('severity')]", "enabled": "[[parameters('enabled')]", @@ -401,12 +418,20 @@ "criteria": { "allOf": [ { - "query": "[[format('arg(\"\").resources | where type == \"microsoft.hybridcompute/machines\" | where tostring(properties.status) == \"Disconnected\" | extend lastContactedDate = todatetime(properties.lastStatusChange) | where lastContactedDate <= ago({0}d) | extend status = tostring(properties.status) | project id, Computer=name, status, lastContactedDate', parameters('threshold'))]", + "query": "[[format('let policyThresholdString = \"{2}\"; arg(\"\").resources | where type == \"microsoft.hybridcompute/machines\" | where parse_json(tostring(tags.{0})) !in~ (\"{1}\") | where tostring(properties.status) == \"Disconnected\" | extend lastContactedDate = todatetime(properties.lastStatusChange) | where lastContactedDate <= ago(totimespan(policyThresholdString)) | extend status = tostring(properties.status) | project id, Computer=name, status, lastContactedDate', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'), parameters('threshold'))]", "resourceIdColumn": "id", "threshold": 0, "operator": "[[parameters('operator')]", "timeAggregation": "[[parameters('timeAggregation')]", - "dimensions": [], + "dimensions": [ + { + "name": "Computer", + "operator": "Include", + "values": [ + "*" + ] + } + ], "failingPeriods": { "numberOfEvaluationPeriods": "[[parameters('evaluationPeriods')]", "minFailingPeriodsToAlert": "[[parameters('failingPeriods')]" @@ -422,14 +447,8 @@ "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" }, - "userAssignedManagedIdentityName": { - "value": "[[parameters('userAssignedManagedIdentityName')]" - }, - "managementSubscriptionId": { - "value": "[[parameters('managementSubscriptionId')]" - }, - "BYOUserAssignedManagedIdentityResourceId": { - "value": "[[parameters('BYOUserAssignedManagedIdentityResourceId')]" + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" }, "severity": { "value": "[[parameters('severity')]" @@ -454,6 +473,12 @@ }, "evaluationPeriods": { "value": "[[parameters('evaluationPeriods')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('MonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('MonitorDisableTagValues')]" } } } @@ -470,14 +495,8 @@ "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" }, - "userAssignedManagedIdentityName": { - "value": "[[parameters('userAssignedManagedIdentityName')]" - }, - "managementSubscriptionId": { - "value": "[[parameters('managementSubscriptionId')]" - }, - "BYOUserAssignedManagedIdentityResourceId": { - "value": "[[parameters('BYOUserAssignedManagedIdentityResourceId')]" + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" } } } @@ -494,14 +513,8 @@ "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" }, - "userAssignedManagedIdentityName": { - "value": "[[parameters('userAssignedManagedIdentityName')]" - }, - "managementSubscriptionId": { - "value": "[[parameters('managementSubscriptionId')]" - }, - "BYOUserAssignedManagedIdentityResourceId": { - "value": "[[parameters('BYOUserAssignedManagedIdentityResourceId')]" + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" }, "severity": { "value": "[[parameters('severity')]" @@ -532,6 +545,12 @@ }, "evaluationPeriods": { "value": "[[parameters('evaluationPeriods')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('MonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('MonitorDisableTagValues')]" } } } diff --git a/services/HybridCompute/machines/Deploy-Hybrid-VM-HeartBeat-Alert.json b/services/HybridCompute/machines/Deploy-Hybrid-VM-HeartBeat-Alert.json index 714af3249..6236f8fd2 100644 --- a/services/HybridCompute/machines/Deploy-Hybrid-VM-HeartBeat-Alert.json +++ b/services/HybridCompute/machines/Deploy-Hybrid-VM-HeartBeat-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy Hybrid VM HeartBeat Alert", "description": "Policy to audit/deploy VM HeartBeat Alert for all VMs in the subscription", "metadata": { - "version": "1.0.1", + "version": "1.2.0", "category": "Hybrid Compute", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -23,7 +23,7 @@ "displayName": "Resource Group Name", "description": "Resource group the alert is placed in" }, - "defaultValue": "AlzMonitoring-rg" + "defaultValue": "rg-amba-monitoring-001" }, "alertResourceGroupTags": { "type": "Object", @@ -32,7 +32,7 @@ "description": "Tags on the Resource group the alert is placed in" }, "defaultValue": { - "environment": "test" + "Project": "amba-monitoring" } }, "alertResourceGroupLocation": { @@ -43,6 +43,14 @@ }, "defaultValue": "centralus" }, + "UAMIResourceId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "The resource Id of the user assigned managed identity.", + "displayName": "User Assigned managed Identity resource Id." + } + }, "severity": { "type": "String", "metadata": { @@ -64,11 +72,7 @@ "displayName": "Operator" }, "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" + "GreaterThan" ], "defaultValue": "GreaterThan" }, @@ -78,13 +82,9 @@ "displayName": "TimeAggregation" }, "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" + "Count" ], - "defaultValue": "Average" + "defaultValue": "Count" }, "windowSize": { "type": "String", @@ -101,7 +101,7 @@ "PT12H", "PT24H" ], - "defaultValue": "PT15M" + "defaultValue": "PT6H" }, "evaluationFrequency": { "type": "String", @@ -185,6 +185,16 @@ }, "defaultValue": "1" }, + "computersToInclude": { + "type": "array", + "metadata": { + "displayName": "Computers to be included to be monitored", + "description": "Array of Computer to be monitored" + }, + "defaultValue": [ + "*" + ] + }, "effect": { "type": "String", "metadata": { @@ -196,6 +206,27 @@ "disabled" ], "defaultValue": "deployIfNotExists" + }, + "MonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name to disable monitoring. Set to true if monitoring should be disabled" + }, + "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -204,6 +235,10 @@ { "field": "type", "equals": "Microsoft.HybridCompute/machines" + }, + { + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -214,7 +249,7 @@ "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c" ], "type": "Microsoft.Insights/scheduledQueryRules", - "existenceScope": "resourcegroup", + "existenceScope": "resourceGroup", "resourceGroupName": "[[parameters('alertResourceGroupName')]", "deploymentScope": "subscription", "existenceCondition": { @@ -224,33 +259,29 @@ "equals": "[[concat(subscription().displayName, '-HybridVMHeartBeatAlert')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/scopes[*]", + "field": "Microsoft.Insights/scheduledQueryRules/scopes[*]", "equals": "[[subscription().id]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/enabled", + "field": "Microsoft.Insights/scheduledQueryRules/enabled", "equals": "[[parameters('enabled')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/evaluationFrequency", + "field": "Microsoft.Insights/scheduledQueryRules/evaluationFrequency", "equals": "[[parameters('evaluationFrequency')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/windowSize", + "field": "Microsoft.Insights/scheduledQueryRules/windowSize", "equals": "[[parameters('windowSize')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/severity", + "field": "Microsoft.Insights/scheduledQueryRules/severity", "equals": "[[parameters('severity')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/autoMitigate", + "field": "Microsoft.Insights/scheduledQueryRules/autoMitigate", "equals": "[[parameters('autoMitigate')]" }, - { - "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold", - "equals": "[[parameters('threshold')]" - }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator", "equals": "[[parameters('operator')]" @@ -269,7 +300,11 @@ }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query", - "equals": "Heartbeat| summarize TimeGenerated=max(TimeGenerated) by Computer, _ResourceId| extend Duration = datetime_diff('minute',now(),TimeGenerated)| summarize AggregatedValue = min(Duration) by Computer, bin(TimeGenerated,5m), _ResourceId" + "equals": "[[format('let policyThresholdString = \"{2}\"; let excludedResources = (arg(\"\").resources | where type =~ \"Microsoft.HybridCompute/machines\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\"{1}\")); let overridenResource = (arg(\"\").resources | where type == \"microsoft.hybridcompute/machines\" | project _ResourceId = tolower(id), tags | where tags contains \"_amba-Heartbeat-threshold-override_\"); Heartbeat | where _ResourceId has \"Microsoft.HybridCompute/machines\" | where _ResourceId !in~ (excludedResources) | summarize TimeGenerated=max(TimeGenerated) by Computer, _ResourceId | extend Duration = datetime_diff(\"minute\",now(),TimeGenerated) | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \"_amba-Heartbeat-threshold-override_\", tostring(tags.[\"_amba-Heartbeat-threshold-override_\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where Duration > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Duration', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'), parameters('threshold'))]" + }, + { + "field": "identity.userAssignedIdentities", + "containsKey": "[[parameters('UAMIResourceId')]" } ] }, @@ -290,6 +325,9 @@ "alertResourceGroupLocation": { "type": "string" }, + "UAMIResourceId": { + "type": "string" + }, "severity": { "type": "String" }, @@ -325,6 +363,15 @@ }, "evaluationPeriods": { "type": "String" + }, + "computersToInclude": { + "type": "array" + }, + "MonitorDisableTagName": { + "type": "String" + }, + "MonitorDisableTagValues": { + "type": "Array" } }, "variables": {}, @@ -339,7 +386,7 @@ { "type": "Microsoft.Resources/deployments", "apiVersion": "2019-10-01", - "name": "HeartBeatAlert", + "name": "HybridVMHeartBeatAlert", "resourceGroup": "[[parameters('alertResourceGroupName')]", "dependsOn": [ "[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]" @@ -358,6 +405,9 @@ }, "alertResourceGroupLocation": { "type": "string" + }, + "UAMIResourceId": { + "type": "string" } }, "variables": {}, @@ -367,6 +417,12 @@ "apiVersion": "2022-08-01-preview", "name": "[[concat(subscription().displayName, '-HybridVMHeartBeatAlert')]", "location": "[[parameters('alertResourceGroupLocation')]", + "identity": { + "type": "UserAssigned", + "userAssignedIdentities": { + "[[parameters('UAMIResourceId')]": {} + } + }, "tags": { "_deployed_by_amba": true }, @@ -386,9 +442,8 @@ "criteria": { "allOf": [ { - "query": "Heartbeat| summarize TimeGenerated=max(TimeGenerated) by Computer, _ResourceId| extend Duration = datetime_diff('minute',now(),TimeGenerated)| summarize AggregatedValue = min(Duration) by Computer, bin(TimeGenerated,5m), _ResourceId", - "metricMeasureColumn": "AggregatedValue", - "threshold": "[[parameters('threshold')]", + "query": "[[format('let policyThresholdString = \"{2}\"; let excludedResources = (arg(\"\").resources | where type =~ \"Microsoft.HybridCompute/machines\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\"{1}\")); let overridenResource = (arg(\"\").resources | where type == \"microsoft.hybridcompute/machines\" | project _ResourceId = tolower(id), tags | where tags contains \"_amba-Heartbeat-threshold-override_\"); Heartbeat | where _ResourceId has \"Microsoft.HybridCompute/machines\" | where _ResourceId !in~ (excludedResources) | summarize TimeGenerated=max(TimeGenerated) by Computer, _ResourceId | extend Duration = datetime_diff(\"minute\",now(),TimeGenerated) | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \"_amba-Heartbeat-threshold-override_\", tostring(tags.[\"_amba-Heartbeat-threshold-override_\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where Duration > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Duration', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'), parameters('threshold'))]", + "threshold": 0, "operator": "[[parameters('operator')]", "resourceIdColumn": "_ResourceId", "timeAggregation": "[[parameters('timeAggregation')]", @@ -396,9 +451,7 @@ { "name": "Computer", "operator": "Include", - "values": [ - "*" - ] + "values": "[[parameters('computersToInclude')]" } ], "failingPeriods": { @@ -420,6 +473,9 @@ "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" + }, "severity": { "value": "[[parameters('severity')]" }, @@ -449,6 +505,15 @@ }, "evaluationPeriods": { "value": "[[parameters('evaluationPeriods')]" + }, + "computersToInclude": { + "value": "[[parameters('computersToInclude')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('MonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('MonitorDisableTagValues')]" } } } @@ -464,6 +529,9 @@ }, "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" + }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" } } } @@ -480,6 +548,9 @@ "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" + }, "severity": { "value": "[[parameters('severity')]" }, @@ -515,6 +586,15 @@ }, "evaluationPeriods": { "value": "[[parameters('evaluationPeriods')]" + }, + "computersToInclude": { + "value": "[[parameters('computersToInclude')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('MonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('MonitorDisableTagValues')]" } } } diff --git a/services/HybridCompute/machines/Deploy-Hybrid-VM-NetworkIn-Alert.json b/services/HybridCompute/machines/Deploy-Hybrid-VM-NetworkIn-Alert.json index 5de4393ed..3aaf365ba 100644 --- a/services/HybridCompute/machines/Deploy-Hybrid-VM-NetworkIn-Alert.json +++ b/services/HybridCompute/machines/Deploy-Hybrid-VM-NetworkIn-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy Hybrid VM Network Read Alert", "description": "Policy to audit/deploy VM Nework Read Alert", "metadata": { - "version": "1.0.1", + "version": "1.2.0", "category": "Hybrid Compute", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -23,7 +23,7 @@ "displayName": "Resource Group Name", "description": "Resource group the alert is placed in" }, - "defaultValue": "AlzMonitoring-rg" + "defaultValue": "rg-amba-monitoring-001" }, "alertResourceGroupTags": { "type": "Object", @@ -32,7 +32,7 @@ "description": "Tags on the Resource group the alert is placed in" }, "defaultValue": { - "environment": "test" + "Project": "amba-monitoring" } }, "alertResourceGroupLocation": { @@ -43,6 +43,14 @@ }, "defaultValue": "centralus" }, + "UAMIResourceId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "The resource Id of the user assigned managed identity.", + "displayName": "User Assigned managed Identity resource Id." + } + }, "severity": { "type": "String", "metadata": { @@ -64,11 +72,7 @@ "displayName": "Operator" }, "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" + "GreaterThan" ], "defaultValue": "GreaterThan" }, @@ -78,13 +82,9 @@ "displayName": "TimeAggregation" }, "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" + "Count" ], - "defaultValue": "Average" + "defaultValue": "Count" }, "windowSize": { "type": "String", @@ -185,16 +185,6 @@ }, "defaultValue": "1" }, - "networkInterfacesToInclude": { - "type": "array", - "metadata": { - "displayName": "Network Interface to be included to be monitored", - "description": "Array of Network Interface to be monitored" - }, - "defaultValue": [ - "*" - ] - }, "computersToInclude": { "type": "array", "metadata": { @@ -216,6 +206,27 @@ "disabled" ], "defaultValue": "deployIfNotExists" + }, + "MonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name to disable monitoring. Set to true if monitoring should be disabled" + }, + "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -224,6 +235,10 @@ { "field": "type", "equals": "Microsoft.HybridCompute/machines" + }, + { + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -234,7 +249,7 @@ "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c" ], "type": "Microsoft.Insights/scheduledQueryRules", - "existenceScope": "resourcegroup", + "existenceScope": "resourceGroup", "resourceGroupName": "[[parameters('alertResourceGroupName')]", "deploymentScope": "subscription", "existenceCondition": { @@ -244,33 +259,29 @@ "equals": "[[concat(subscription().displayName, '-HybridVMHighNetworkInAlert')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/scopes[*]", + "field": "Microsoft.Insights/scheduledQueryRules/scopes[*]", "equals": "[[subscription().id]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/enabled", + "field": "Microsoft.Insights/scheduledQueryRules/enabled", "equals": "[[parameters('enabled')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/evaluationFrequency", + "field": "Microsoft.Insights/scheduledQueryRules/evaluationFrequency", "equals": "[[parameters('evaluationFrequency')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/windowSize", + "field": "Microsoft.Insights/scheduledQueryRules/windowSize", "equals": "[[parameters('windowSize')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/severity", + "field": "Microsoft.Insights/scheduledQueryRules/severity", "equals": "[[parameters('severity')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/autoMitigate", + "field": "Microsoft.Insights/scheduledQueryRules/autoMitigate", "equals": "[[parameters('autoMitigate')]" }, - { - "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold", - "equals": "[[parameters('threshold')]" - }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator", "equals": "[[parameters('operator')]" @@ -289,7 +300,11 @@ }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query", - "equals": "InsightsMetrics| where Origin == \"vm.azm.ms\"| where Namespace == \"Network\" and Name == \"ReadBytesPerSecond\"| extend NetworkInterface=tostring(todynamic(Tags)[\"vm.azm.ms/networkDeviceId\"])|summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface" + "equals": "[[format('let policyThresholdString = \"{2}\"; let excludedResources = (arg(\"\").resources | where type =~ \"Microsoft.HybridCompute/machines\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\"{1}\")); let overridenResource = (arg(\"\").resources | where type == \"microsoft.hybridcompute/machines\" | project _ResourceId = tolower(id), tags | where tags contains \"_amba-ReadBytesPerSecond-Data-threshold-override_\"); InsightsMetrics | where _ResourceId has \"Microsoft.HybridCompute/machines\" | where _ResourceId !in~ (excludedResources) | where Origin == \"vm.azm.ms\" | where Namespace == \"Network\" and Name == \"ReadBytesPerSecond\" | extend NetworkInterface=tostring(todynamic(Tags)[\"vm.azm.ms/networkDeviceId\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \"_amba-ReadBytesPerSecond-Data-threshold-override_\", tostring(tags.[\"_amba-ReadBytesPerSecond-Data-threshold-override_\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'), parameters('threshold'))]" + }, + { + "field": "identity.userAssignedIdentities", + "containsKey": "[[parameters('UAMIResourceId')]" } ] }, @@ -310,6 +325,9 @@ "alertResourceGroupLocation": { "type": "string" }, + "UAMIResourceId": { + "type": "string" + }, "severity": { "type": "String" }, @@ -349,8 +367,11 @@ "computersToInclude": { "type": "array" }, - "networkInterfacesToInclude": { - "type": "array" + "MonitorDisableTagName": { + "type": "String" + }, + "MonitorDisableTagValues": { + "type": "Array" } }, "variables": {}, @@ -365,7 +386,7 @@ { "type": "Microsoft.Resources/deployments", "apiVersion": "2019-10-01", - "name": "VMNetworkInAlert", + "name": "HybridVMVMNetworkInAlert", "resourceGroup": "[[parameters('alertResourceGroupName')]", "dependsOn": [ "[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]" @@ -384,6 +405,9 @@ }, "alertResourceGroupLocation": { "type": "string" + }, + "UAMIResourceId": { + "type": "string" } }, "variables": {}, @@ -393,6 +417,12 @@ "apiVersion": "2022-08-01-preview", "name": "[[concat(subscription().displayName, '-HybridVMHighNetworkInAlert')]", "location": "[[parameters('alertResourceGroupLocation')]", + "identity": { + "type": "UserAssigned", + "userAssignedIdentities": { + "[[parameters('UAMIResourceId')]": {} + } + }, "tags": { "_deployed_by_amba": true }, @@ -412,9 +442,8 @@ "criteria": { "allOf": [ { - "query": "InsightsMetrics| where Origin == \"vm.azm.ms\"| where Namespace == \"Network\" and Name == \"ReadBytesPerSecond\"| extend NetworkInterface=tostring(todynamic(Tags)[\"vm.azm.ms/networkDeviceId\"])|summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface", - "metricMeasureColumn": "AggregatedValue", - "threshold": "[[parameters('threshold')]", + "query": "[[format('let policyThresholdString = \"{2}\"; let excludedResources = (arg(\"\").resources | where type =~ \"Microsoft.HybridCompute/machines\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\"{1}\")); let overridenResource = (arg(\"\").resources | where type == \"microsoft.hybridcompute/machines\" | project _ResourceId = tolower(id), tags | where tags contains \"_amba-ReadBytesPerSecond-Data-threshold-override_\"); InsightsMetrics | where _ResourceId has \"Microsoft.HybridCompute/machines\" | where _ResourceId !in~ (excludedResources) | where Origin == \"vm.azm.ms\" | where Namespace == \"Network\" and Name == \"ReadBytesPerSecond\" | extend NetworkInterface=tostring(todynamic(Tags)[\"vm.azm.ms/networkDeviceId\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \"_amba-ReadBytesPerSecond-Data-threshold-override_\", tostring(tags.[\"_amba-ReadBytesPerSecond-Data-threshold-override_\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'), parameters('threshold'))]", + "threshold": 0, "operator": "[[parameters('operator')]", "resourceIdColumn": "_ResourceId", "timeAggregation": "[[parameters('timeAggregation')]", @@ -427,7 +456,9 @@ { "name": "NetworkInterface", "operator": "Include", - "values": "[[parameters('networkInterfacesToInclude')]" + "values": [ + "*" + ] } ], "failingPeriods": { @@ -449,6 +480,9 @@ "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" + }, "severity": { "value": "[[parameters('severity')]" }, @@ -482,8 +516,11 @@ "computersToInclude": { "value": "[[parameters('computersToInclude')]" }, - "networkInterfacesToInclude": { - "value": "[[parameters('networkInterfacesToInclude')]" + "MonitorDisableTagName": { + "value": "[[parameters('MonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('MonitorDisableTagValues')]" } } } @@ -499,6 +536,9 @@ }, "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" + }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" } } } @@ -515,6 +555,9 @@ "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" + }, "severity": { "value": "[[parameters('severity')]" }, @@ -554,8 +597,11 @@ "computersToInclude": { "value": "[[parameters('computersToInclude')]" }, - "networkInterfacesToInclude": { - "value": "[[parameters('networkInterfacesToInclude')]" + "MonitorDisableTagName": { + "value": "[[parameters('MonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('MonitorDisableTagValues')]" } } } diff --git a/services/HybridCompute/machines/Deploy-Hybrid-VM-NetworkOut-Alert.json b/services/HybridCompute/machines/Deploy-Hybrid-VM-NetworkOut-Alert.json index 6244904f5..3dc29a156 100644 --- a/services/HybridCompute/machines/Deploy-Hybrid-VM-NetworkOut-Alert.json +++ b/services/HybridCompute/machines/Deploy-Hybrid-VM-NetworkOut-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy Hybrid VM Network Write Alert", "description": "Policy to audit/deploy VM Network Out Alert", "metadata": { - "version": "1.0.1", + "version": "1.2.0", "category": "Hybrid Compute", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -23,7 +23,7 @@ "displayName": "Resource Group Name", "description": "Resource group the alert is placed in" }, - "defaultValue": "AlzMonitoring-rg" + "defaultValue": "rg-amba-monitoring-001" }, "alertResourceGroupTags": { "type": "Object", @@ -32,7 +32,7 @@ "description": "Tags on the Resource group the alert is placed in" }, "defaultValue": { - "environment": "test" + "Project": "amba-monitoring" } }, "alertResourceGroupLocation": { @@ -43,6 +43,14 @@ }, "defaultValue": "centralus" }, + "UAMIResourceId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "The resource Id of the user assigned managed identity.", + "displayName": "User Assigned managed Identity resource Id." + } + }, "severity": { "type": "String", "metadata": { @@ -64,11 +72,7 @@ "displayName": "Operator" }, "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" + "GreaterThan" ], "defaultValue": "GreaterThan" }, @@ -78,13 +82,9 @@ "displayName": "TimeAggregation" }, "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" + "Count" ], - "defaultValue": "Average" + "defaultValue": "Count" }, "windowSize": { "type": "String", @@ -195,16 +195,6 @@ "*" ] }, - "networkInterfacesToInclude": { - "type": "array", - "metadata": { - "displayName": "Network Interface to be included to be monitored", - "description": "Array of Network Interface to be monitored" - }, - "defaultValue": [ - "*" - ] - }, "effect": { "type": "String", "metadata": { @@ -216,6 +206,27 @@ "disabled" ], "defaultValue": "deployIfNotExists" + }, + "MonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name to disable monitoring. Set to true if monitoring should be disabled" + }, + "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -224,6 +235,10 @@ { "field": "type", "equals": "Microsoft.HybridCompute/machines" + }, + { + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -234,7 +249,7 @@ "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c" ], "type": "Microsoft.Insights/scheduledQueryRules", - "existenceScope": "resourcegroup", + "existenceScope": "resourceGroup", "resourceGroupName": "[[parameters('alertResourceGroupName')]", "deploymentScope": "subscription", "existenceCondition": { @@ -244,33 +259,29 @@ "equals": "[[concat(subscription().displayName, '-HybridVMHighNetworkOutAlert')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/scopes[*]", + "field": "Microsoft.Insights/scheduledQueryRules/scopes[*]", "equals": "[[subscription().id]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/enabled", + "field": "Microsoft.Insights/scheduledQueryRules/enabled", "equals": "[[parameters('enabled')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/evaluationFrequency", + "field": "Microsoft.Insights/scheduledQueryRules/evaluationFrequency", "equals": "[[parameters('evaluationFrequency')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/windowSize", + "field": "Microsoft.Insights/scheduledQueryRules/windowSize", "equals": "[[parameters('windowSize')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/severity", + "field": "Microsoft.Insights/scheduledQueryRules/severity", "equals": "[[parameters('severity')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/autoMitigate", + "field": "Microsoft.Insights/scheduledQueryRules/autoMitigate", "equals": "[[parameters('autoMitigate')]" }, - { - "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold", - "equals": "[[parameters('threshold')]" - }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator", "equals": "[[parameters('operator')]" @@ -289,7 +300,11 @@ }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query", - "equals": "InsightsMetrics| where Origin == \"vm.azm.ms\"| where Namespace == \"Network\" and Name == \"WriteBytesPerSecond\"| extend NetworkInterface=tostring(todynamic(Tags)[\"vm.azm.ms/networkDeviceId\"])|summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface" + "equals": "[[format('let policyThresholdString = \"{2}\"; let excludedResources = (arg(\"\").resources | where type =~ \"Microsoft.HybridCompute/machines\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\"{1}\")); let overridenResource = (arg(\"\").resources | where type == \"microsoft.hybridcompute/machines\" | project _ResourceId = tolower(id), tags | where tags contains \"_amba-WriteBytesPerSecond-Data-threshold-override_\"); InsightsMetrics | where _ResourceId has \"Microsoft.HybridCompute/machines\" | where _ResourceId !in~ (excludedResources) | where Origin == \"vm.azm.ms\" | where Namespace == \"Network\" and Name == \"WriteBytesPerSecond\" | extend NetworkInterface=tostring(todynamic(Tags)[\"vm.azm.ms/networkDeviceId\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \"_amba-WriteBytesPerSecond-Data-threshold-override_\", tostring(tags.[\"_amba-WriteBytesPerSecond-Data-threshold-override_\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'), parameters('threshold'))]" + }, + { + "field": "identity.userAssignedIdentities", + "containsKey": "[[parameters('UAMIResourceId')]" } ] }, @@ -310,6 +325,9 @@ "alertResourceGroupLocation": { "type": "string" }, + "UAMIResourceId": { + "type": "string" + }, "severity": { "type": "String" }, @@ -349,8 +367,11 @@ "computersToInclude": { "type": "array" }, - "networkInterfacesToInclude": { - "type": "array" + "MonitorDisableTagName": { + "type": "String" + }, + "MonitorDisableTagValues": { + "type": "Array" } }, "variables": {}, @@ -365,7 +386,7 @@ { "type": "Microsoft.Resources/deployments", "apiVersion": "2019-10-01", - "name": "VMNetworkOutAlert", + "name": "HybridVMVMNetworkOutAlert", "resourceGroup": "[[parameters('alertResourceGroupName')]", "dependsOn": [ "[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]" @@ -384,6 +405,9 @@ }, "alertResourceGroupLocation": { "type": "string" + }, + "UAMIResourceId": { + "type": "string" } }, "variables": {}, @@ -393,6 +417,12 @@ "apiVersion": "2022-08-01-preview", "name": "[[concat(subscription().displayName, '-HybridVMHighNetworkOutAlert')]", "location": "[[parameters('alertResourceGroupLocation')]", + "identity": { + "type": "UserAssigned", + "userAssignedIdentities": { + "[[parameters('UAMIResourceId')]": {} + } + }, "tags": { "_deployed_by_amba": true }, @@ -412,9 +442,8 @@ "criteria": { "allOf": [ { - "query": "InsightsMetrics| where Origin == \"vm.azm.ms\"| where Namespace == \"Network\" and Name == \"WriteBytesPerSecond\"| extend NetworkInterface=tostring(todynamic(Tags)[\"vm.azm.ms/networkDeviceId\"])|summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface", - "metricMeasureColumn": "AggregatedValue", - "threshold": "[[parameters('threshold')]", + "query": "[[format('let policyThresholdString = \"{2}\"; let excludedResources = (arg(\"\").resources | where type =~ \"Microsoft.HybridCompute/machines\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\"{1}\")); let overridenResource = (arg(\"\").resources | where type == \"microsoft.hybridcompute/machines\" | project _ResourceId = tolower(id), tags | where tags contains \"_amba-WriteBytesPerSecond-Data-threshold-override_\"); InsightsMetrics | where _ResourceId has \"Microsoft.HybridCompute/machines\" | where _ResourceId !in~ (excludedResources) | where Origin == \"vm.azm.ms\" | where Namespace == \"Network\" and Name == \"WriteBytesPerSecond\" | extend NetworkInterface=tostring(todynamic(Tags)[\"vm.azm.ms/networkDeviceId\"]) | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, NetworkInterface | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \"_amba-WriteBytesPerSecond-Data-threshold-override_\", tostring(tags.[\"_amba-WriteBytesPerSecond-Data-threshold-override_\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, NetworkInterface, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'), parameters('threshold'))]", + "threshold": 0, "operator": "[[parameters('operator')]", "resourceIdColumn": "_ResourceId", "timeAggregation": "[[parameters('timeAggregation')]", @@ -427,7 +456,9 @@ { "name": "NetworkInterface", "operator": "Include", - "values": "[[parameters('networkInterfacesToInclude')]" + "values": [ + "*" + ] } ], "failingPeriods": { @@ -449,6 +480,9 @@ "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" + }, "severity": { "value": "[[parameters('severity')]" }, @@ -482,8 +516,11 @@ "computersToInclude": { "value": "[[parameters('computersToInclude')]" }, - "networkInterfacesToInclude": { - "value": "[[parameters('networkInterfacesToInclude')]" + "MonitorDisableTagName": { + "value": "[[parameters('MonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('MonitorDisableTagValues')]" } } } @@ -499,6 +536,9 @@ }, "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" + }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" } } } @@ -515,6 +555,9 @@ "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" + }, "severity": { "value": "[[parameters('severity')]" }, @@ -554,8 +597,11 @@ "computersToInclude": { "value": "[[parameters('computersToInclude')]" }, - "networkInterfacesToInclude": { - "value": "[[parameters('networkInterfacesToInclude')]" + "MonitorDisableTagName": { + "value": "[[parameters('MonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('MonitorDisableTagValues')]" } } } diff --git a/services/HybridCompute/machines/Deploy-Hybrid-VM-OSDiskReadLatency-Alert.json b/services/HybridCompute/machines/Deploy-Hybrid-VM-OSDiskReadLatency-Alert.json index 5b3de0055..465d7cc05 100644 --- a/services/HybridCompute/machines/Deploy-Hybrid-VM-OSDiskReadLatency-Alert.json +++ b/services/HybridCompute/machines/Deploy-Hybrid-VM-OSDiskReadLatency-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy Hybrid VM OS Disk Read Latency Alert", "description": "Policy to audit/deploy VM OSDiskreadLatency Alert", "metadata": { - "version": "1.0.1", + "version": "1.2.0", "category": "Hybrid Compute", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -23,7 +23,7 @@ "displayName": "Resource Group Name", "description": "Resource group the alert is placed in" }, - "defaultValue": "AlzMonitoring-rg" + "defaultValue": "rg-amba-monitoring-001" }, "alertResourceGroupTags": { "type": "Object", @@ -32,7 +32,7 @@ "description": "Tags on the Resource group the alert is placed in" }, "defaultValue": { - "environment": "test" + "Project": "amba-monitoring" } }, "alertResourceGroupLocation": { @@ -43,6 +43,14 @@ }, "defaultValue": "centralus" }, + "UAMIResourceId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "The resource Id of the user assigned managed identity.", + "displayName": "User Assigned managed Identity resource Id." + } + }, "severity": { "type": "String", "metadata": { @@ -64,11 +72,7 @@ "displayName": "Operator" }, "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" + "GreaterThan" ], "defaultValue": "GreaterThan" }, @@ -78,13 +82,9 @@ "displayName": "TimeAggregation" }, "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" + "Count" ], - "defaultValue": "Average" + "defaultValue": "Count" }, "windowSize": { "type": "String", @@ -188,24 +188,13 @@ "computersToInclude": { "type": "array", "metadata": { - "displayName": "Disks to be included to be monitored", + "displayName": "Computers to be included to be monitored", "description": "Array of Computer to be monitored" }, "defaultValue": [ "*" ] }, - "disksToInclude": { - "type": "array", - "metadata": { - "displayName": "Disks to be included to be monitored", - "description": "Array of disk to be monitored for disk both windows and linux" - }, - "defaultValue": [ - "C:", - "/" - ] - }, "effect": { "type": "String", "metadata": { @@ -217,6 +206,27 @@ "disabled" ], "defaultValue": "deployIfNotExists" + }, + "MonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name to disable monitoring. Set to true if monitoring should be disabled" + }, + "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -225,6 +235,10 @@ { "field": "type", "equals": "Microsoft.HybridCompute/machines" + }, + { + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -235,43 +249,39 @@ "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c" ], "type": "Microsoft.Insights/scheduledQueryRules", - "existenceScope": "resourcegroup", + "existenceScope": "resourceGroup", "resourceGroupName": "[[parameters('alertResourceGroupName')]", "deploymentScope": "subscription", "existenceCondition": { "allOf": [ { "field": "Microsoft.Insights/scheduledQueryRules/displayName", - "equals": "[[concat(subscription().displayName, '-HybridVMLowOSDiskreadLatencyAlert')]" + "equals": "[[concat(subscription().displayName, '-HybridVMHighOSDiskReadLatencyAlert')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/scopes[*]", + "field": "Microsoft.Insights/scheduledQueryRules/scopes[*]", "equals": "[[subscription().id]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/enabled", + "field": "Microsoft.Insights/scheduledQueryRules/enabled", "equals": "[[parameters('enabled')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/evaluationFrequency", + "field": "Microsoft.Insights/scheduledQueryRules/evaluationFrequency", "equals": "[[parameters('evaluationFrequency')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/windowSize", + "field": "Microsoft.Insights/scheduledQueryRules/windowSize", "equals": "[[parameters('windowSize')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/severity", + "field": "Microsoft.Insights/scheduledQueryRules/severity", "equals": "[[parameters('severity')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/autoMitigate", + "field": "Microsoft.Insights/scheduledQueryRules/autoMitigate", "equals": "[[parameters('autoMitigate')]" }, - { - "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold", - "equals": "[[parameters('threshold')]" - }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator", "equals": "[[parameters('operator')]" @@ -290,7 +300,11 @@ }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query", - "equals": "InsightsMetrics| where Origin == \"vm.azm.ms\"| where Namespace == \"LogicalDisk\" and Name == \"ReadLatencyMs\"| extend Disk=tostring(todynamic(Tags)[\"vm.azm.ms/mountId\"])| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk" + "equals": "[[format('let policyThresholdString = \"{2}\"; let excludedResources = (arg(\"\").resources | where type =~ \"Microsoft.HybridCompute/machines\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\"{1}\")); let overridenResource = (arg(\"\").resources | where type == \"microsoft.hybridcompute/machines\" | project _ResourceId = tolower(id), tags | where tags contains \"_amba-ReadLatencyMs-OS-threshold-override_\"); InsightsMetrics | where _ResourceId has \"Microsoft.HybridCompute/machines\" | where _ResourceId !in~ (excludedResources) | where Origin == \"vm.azm.ms\" | where Namespace == \"LogicalDisk\" and Name == \"ReadLatencyMs\" | extend Disk=tostring(todynamic(Tags)[\"vm.azm.ms/mountId\"]) | where Disk in (\"C:\",\"/\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \"_amba-ReadLatencyMs-OS-threshold-override_\", tostring(tags.[\"_amba-ReadLatencyMs-OS-threshold-override_\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'), parameters('threshold'))]" + }, + { + "field": "identity.userAssignedIdentities", + "containsKey": "[[parameters('UAMIResourceId')]" } ] }, @@ -311,6 +325,9 @@ "alertResourceGroupLocation": { "type": "string" }, + "UAMIResourceId": { + "type": "string" + }, "severity": { "type": "String" }, @@ -347,11 +364,14 @@ "evaluationPeriods": { "type": "String" }, - "disksToInclude": { - "type": "array" - }, "computersToInclude": { "type": "array" + }, + "MonitorDisableTagName": { + "type": "String" + }, + "MonitorDisableTagValues": { + "type": "Array" } }, "variables": {}, @@ -366,7 +386,7 @@ { "type": "Microsoft.Resources/deployments", "apiVersion": "2019-10-01", - "name": "VMOSDiskreadLatencyAlert", + "name": "HybridVMOSDiskreadLatencyAlert", "resourceGroup": "[[parameters('alertResourceGroupName')]", "dependsOn": [ "[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]" @@ -385,6 +405,9 @@ }, "alertResourceGroupLocation": { "type": "string" + }, + "UAMIResourceId": { + "type": "string" } }, "variables": {}, @@ -392,13 +415,19 @@ { "type": "Microsoft.Insights/scheduledQueryRules", "apiVersion": "2022-08-01-preview", - "name": "[[concat(subscription().displayName, '-HybridVMLowOSDiskreadLatencyAlert')]", + "name": "[[concat(subscription().displayName, '-HybridVMHighOSDiskReadLatencyAlert')]", "location": "[[parameters('alertResourceGroupLocation')]", + "identity": { + "type": "UserAssigned", + "userAssignedIdentities": { + "[[parameters('UAMIResourceId')]": {} + } + }, "tags": { "_deployed_by_amba": true }, "properties": { - "displayName": "[[concat(subscription().displayName, '-HybridVMLowOSDiskreadLatencyAlert')]", + "displayName": "[[concat(subscription().displayName, '-HybridVMHighOSDiskReadLatencyAlert')]", "description": "Log Alert for Virtual Machine OSDiskreadLatency", "severity": "[[parameters('severity')]", "enabled": "[[parameters('enabled')]", @@ -413,9 +442,8 @@ "criteria": { "allOf": [ { - "query": "InsightsMetrics| where Origin == \"vm.azm.ms\"| where Namespace == \"LogicalDisk\" and Name == \"ReadLatencyMs\"| extend Disk=tostring(todynamic(Tags)[\"vm.azm.ms/mountId\"])| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk", - "metricMeasureColumn": "AggregatedValue", - "threshold": "[[parameters('threshold')]", + "query": "[[format('let policyThresholdString = \"{2}\"; let excludedResources = (arg(\"\").resources | where type =~ \"Microsoft.HybridCompute/machines\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\"{1}\")); let overridenResource = (arg(\"\").resources | where type == \"microsoft.hybridcompute/machines\" | project _ResourceId = tolower(id), tags | where tags contains \"_amba-ReadLatencyMs-OS-threshold-override_\"); InsightsMetrics | where _ResourceId has \"Microsoft.HybridCompute/machines\" | where _ResourceId !in~ (excludedResources) | where Origin == \"vm.azm.ms\" | where Namespace == \"LogicalDisk\" and Name == \"ReadLatencyMs\" | extend Disk=tostring(todynamic(Tags)[\"vm.azm.ms/mountId\"]) | where Disk in (\"C:\",\"/\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \"_amba-ReadLatencyMs-OS-threshold-override_\", tostring(tags.[\"_amba-ReadLatencyMs-OS-threshold-override_\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'), parameters('threshold'))]", + "threshold": 0, "operator": "[[parameters('operator')]", "resourceIdColumn": "_ResourceId", "timeAggregation": "[[parameters('timeAggregation')]", @@ -428,7 +456,9 @@ { "name": "Disk", "operator": "Include", - "values": "[[parameters('disksToInclude')]" + "values": [ + "*" + ] } ], "failingPeriods": { @@ -450,6 +480,9 @@ "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" + }, "severity": { "value": "[[parameters('severity')]" }, @@ -480,11 +513,14 @@ "evaluationPeriods": { "value": "[[parameters('evaluationPeriods')]" }, - "disksToInclude": { - "value": "[[parameters('disksToInclude')]" - }, "computersToInclude": { "value": "[[parameters('computersToInclude')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('MonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('MonitorDisableTagValues')]" } } } @@ -500,6 +536,9 @@ }, "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" + }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" } } } @@ -516,6 +555,9 @@ "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" + }, "severity": { "value": "[[parameters('severity')]" }, @@ -552,11 +594,14 @@ "evaluationPeriods": { "value": "[[parameters('evaluationPeriods')]" }, - "disksToInclude": { - "value": "[[parameters('disksToInclude')]" - }, "computersToInclude": { "value": "[[parameters('computersToInclude')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('MonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('MonitorDisableTagValues')]" } } } diff --git a/services/HybridCompute/machines/Deploy-Hybrid-VM-OSDiskSpace-Alert.json b/services/HybridCompute/machines/Deploy-Hybrid-VM-OSDiskSpace-Alert.json index 720f8d5f2..7b01b85c6 100644 --- a/services/HybridCompute/machines/Deploy-Hybrid-VM-OSDiskSpace-Alert.json +++ b/services/HybridCompute/machines/Deploy-Hybrid-VM-OSDiskSpace-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy Hybrid VM OS Disk Space Alert", "description": "Policy to audit/deploy VM OSDiskSpace Alert", "metadata": { - "version": "1.0.1", + "version": "1.2.0", "category": "Hybrid Compute", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -23,7 +23,7 @@ "displayName": "Resource Group Name", "description": "Resource group the alert is placed in" }, - "defaultValue": "AlzMonitoring-rg" + "defaultValue": "rg-amba-monitoring-001" }, "alertResourceGroupTags": { "type": "Object", @@ -32,7 +32,7 @@ "description": "Tags on the Resource group the alert is placed in" }, "defaultValue": { - "environment": "test" + "Project": "amba-monitoring" } }, "alertResourceGroupLocation": { @@ -43,6 +43,14 @@ }, "defaultValue": "centralus" }, + "UAMIResourceId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "The resource Id of the user assigned managed identity.", + "displayName": "User Assigned managed Identity resource Id." + } + }, "severity": { "type": "String", "metadata": { @@ -64,13 +72,9 @@ "displayName": "Operator" }, "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" + "GreaterThan" ], - "defaultValue": "LessThan" + "defaultValue": "GreaterThan" }, "timeAggregation": { "type": "String", @@ -78,13 +82,9 @@ "displayName": "TimeAggregation" }, "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" + "Count" ], - "defaultValue": "Average" + "defaultValue": "Count" }, "windowSize": { "type": "String", @@ -188,24 +188,13 @@ "computersToInclude": { "type": "array", "metadata": { - "displayName": "Disks to be included to be monitored", + "displayName": "Computers to be included to be monitored", "description": "Array of Computer to be monitored" }, "defaultValue": [ "*" ] }, - "disksToInclude": { - "type": "array", - "metadata": { - "displayName": "Disks to be included to be monitored", - "description": "Array of disk to be monitored for disk both windows and linux" - }, - "defaultValue": [ - "C:", - "/" - ] - }, "effect": { "type": "String", "metadata": { @@ -217,6 +206,27 @@ "disabled" ], "defaultValue": "deployIfNotExists" + }, + "MonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name to disable monitoring. Set to true if monitoring should be disabled" + }, + "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -225,6 +235,10 @@ { "field": "type", "equals": "Microsoft.HybridCompute/machines" + }, + { + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -235,7 +249,7 @@ "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c" ], "type": "Microsoft.Insights/scheduledQueryRules", - "existenceScope": "resourcegroup", + "existenceScope": "resourceGroup", "resourceGroupName": "[[parameters('alertResourceGroupName')]", "deploymentScope": "subscription", "existenceCondition": { @@ -245,33 +259,29 @@ "equals": "[[concat(subscription().displayName, '-HybridVMLowOSDiskSpaceAlert')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/scopes[*]", + "field": "Microsoft.Insights/scheduledQueryRules/scopes[*]", "equals": "[[subscription().id]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/enabled", + "field": "Microsoft.Insights/scheduledQueryRules/enabled", "equals": "[[parameters('enabled')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/evaluationFrequency", + "field": "Microsoft.Insights/scheduledQueryRules/evaluationFrequency", "equals": "[[parameters('evaluationFrequency')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/windowSize", + "field": "Microsoft.Insights/scheduledQueryRules/windowSize", "equals": "[[parameters('windowSize')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/severity", + "field": "Microsoft.Insights/scheduledQueryRules/severity", "equals": "[[parameters('severity')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/autoMitigate", + "field": "Microsoft.Insights/scheduledQueryRules/autoMitigate", "equals": "[[parameters('autoMitigate')]" }, - { - "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold", - "equals": "[[parameters('threshold')]" - }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator", "equals": "[[parameters('operator')]" @@ -290,7 +300,11 @@ }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query", - "equals": "InsightsMetrics| where Origin == \"vm.azm.ms\"| where Namespace == \"LogicalDisk\" and Name == \"FreeSpacePercentage\"| extend Disk=tostring(todynamic(Tags)[\"vm.azm.ms/mountId\"])| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk" + "equals": "[[format('let policyThresholdString = \"{2}\"; let excludedResources = (arg(\"\").resources | where type =~ \"Microsoft.HybridCompute/machines\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\"{1}\")); let overridenResource = (arg(\"\").resources | where type == \"microsoft.hybridcompute/machines\" | project _ResourceId = tolower(id), tags | where tags contains \"_amba-FreeSpacePercentage-OS-threshold-override_\"); InsightsMetrics | where _ResourceId has \"Microsoft.HybridCompute/machines\" | where _ResourceId !in~ (excludedResources) | where Origin == \"vm.azm.ms\" | where Namespace == \"LogicalDisk\" and Name == \"FreeSpacePercentage\" | extend Disk=tostring(todynamic(Tags)[\"vm.azm.ms/mountId\"]) | where Disk in (\"C:\",\"/\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \"_amba-FreeSpacePercentage-OS-threshold-override_\", tostring(tags.[\"_amba-FreeSpacePercentage-OS-threshold-override_\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'), parameters('threshold'))]" + }, + { + "field": "identity.userAssignedIdentities", + "containsKey": "[[parameters('UAMIResourceId')]" } ] }, @@ -311,6 +325,9 @@ "alertResourceGroupLocation": { "type": "string" }, + "UAMIResourceId": { + "type": "string" + }, "severity": { "type": "String" }, @@ -347,11 +364,14 @@ "evaluationPeriods": { "type": "String" }, - "disksToInclude": { - "type": "array" - }, "computersToInclude": { "type": "array" + }, + "MonitorDisableTagName": { + "type": "String" + }, + "MonitorDisableTagValues": { + "type": "Array" } }, "variables": {}, @@ -366,7 +386,7 @@ { "type": "Microsoft.Resources/deployments", "apiVersion": "2019-10-01", - "name": "VMOSDiskSpaceAlert", + "name": "HybridVMOSDiskSpaceAlert", "resourceGroup": "[[parameters('alertResourceGroupName')]", "dependsOn": [ "[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]" @@ -385,6 +405,9 @@ }, "alertResourceGroupLocation": { "type": "string" + }, + "UAMIResourceId": { + "type": "string" } }, "variables": {}, @@ -394,6 +417,12 @@ "apiVersion": "2022-08-01-preview", "name": "[[concat(subscription().displayName, '-HybridVMLowOSDiskSpaceAlert')]", "location": "[[parameters('alertResourceGroupLocation')]", + "identity": { + "type": "UserAssigned", + "userAssignedIdentities": { + "[[parameters('UAMIResourceId')]": {} + } + }, "tags": { "_deployed_by_amba": true }, @@ -413,9 +442,8 @@ "criteria": { "allOf": [ { - "query": "InsightsMetrics| where Origin == \"vm.azm.ms\"| where Namespace == \"LogicalDisk\" and Name == \"FreeSpacePercentage\"| extend Disk=tostring(todynamic(Tags)[\"vm.azm.ms/mountId\"])| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk", - "metricMeasureColumn": "AggregatedValue", - "threshold": "[[parameters('threshold')]", + "query": "[[format('let policyThresholdString = \"{2}\"; let excludedResources = (arg(\"\").resources | where type =~ \"Microsoft.HybridCompute/machines\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\"{1}\")); let overridenResource = (arg(\"\").resources | where type == \"microsoft.hybridcompute/machines\" | project _ResourceId = tolower(id), tags | where tags contains \"_amba-FreeSpacePercentage-OS-threshold-override_\"); InsightsMetrics | where _ResourceId has \"Microsoft.HybridCompute/machines\" | where _ResourceId !in~ (excludedResources) | where Origin == \"vm.azm.ms\" | where Namespace == \"LogicalDisk\" and Name == \"FreeSpacePercentage\" | extend Disk=tostring(todynamic(Tags)[\"vm.azm.ms/mountId\"]) | where Disk in (\"C:\",\"/\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \"_amba-FreeSpacePercentage-OS-threshold-override_\", tostring(tags.[\"_amba-FreeSpacePercentage-OS-threshold-override_\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'), parameters('threshold'))]", + "threshold": 0, "operator": "[[parameters('operator')]", "resourceIdColumn": "_ResourceId", "timeAggregation": "[[parameters('timeAggregation')]", @@ -428,7 +456,9 @@ { "name": "Disk", "operator": "Include", - "values": "[[parameters('disksToInclude')]" + "values": [ + "*" + ] } ], "failingPeriods": { @@ -450,6 +480,9 @@ "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" + }, "severity": { "value": "[[parameters('severity')]" }, @@ -480,11 +513,14 @@ "evaluationPeriods": { "value": "[[parameters('evaluationPeriods')]" }, - "disksToInclude": { - "value": "[[parameters('disksToInclude')]" - }, "computersToInclude": { "value": "[[parameters('computersToInclude')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('MonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('MonitorDisableTagValues')]" } } } @@ -500,6 +536,9 @@ }, "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" + }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" } } } @@ -516,6 +555,9 @@ "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" + }, "severity": { "value": "[[parameters('severity')]" }, @@ -552,11 +594,14 @@ "evaluationPeriods": { "value": "[[parameters('evaluationPeriods')]" }, - "disksToInclude": { - "value": "[[parameters('disksToInclude')]" - }, "computersToInclude": { "value": "[[parameters('computersToInclude')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('MonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('MonitorDisableTagValues')]" } } } diff --git a/services/HybridCompute/machines/Deploy-Hybrid-VM-OSDiskWriteLatency-Alert.json b/services/HybridCompute/machines/Deploy-Hybrid-VM-OSDiskWriteLatency-Alert.json index 23aa93151..3ef0f4429 100644 --- a/services/HybridCompute/machines/Deploy-Hybrid-VM-OSDiskWriteLatency-Alert.json +++ b/services/HybridCompute/machines/Deploy-Hybrid-VM-OSDiskWriteLatency-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy Hybrid VM OS Disk Write Latency Alert", "description": "Policy to audit/deploy VM OSDiskwriteLatency Alert", "metadata": { - "version": "1.0.1", + "version": "1.2.0", "category": "Hybrid Compute", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -23,7 +23,7 @@ "displayName": "Resource Group Name", "description": "Resource group the alert is placed in" }, - "defaultValue": "AlzMonitoring-rg" + "defaultValue": "rg-amba-monitoring-001" }, "alertResourceGroupTags": { "type": "Object", @@ -32,7 +32,7 @@ "description": "Tags on the Resource group the alert is placed in" }, "defaultValue": { - "environment": "test" + "Project": "amba-monitoring" } }, "alertResourceGroupLocation": { @@ -43,6 +43,14 @@ }, "defaultValue": "centralus" }, + "UAMIResourceId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "The resource Id of the user assigned managed identity.", + "displayName": "User Assigned managed Identity resource Id." + } + }, "severity": { "type": "String", "metadata": { @@ -64,11 +72,7 @@ "displayName": "Operator" }, "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" + "GreaterThan" ], "defaultValue": "GreaterThan" }, @@ -78,13 +82,9 @@ "displayName": "TimeAggregation" }, "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" + "Count" ], - "defaultValue": "Average" + "defaultValue": "Count" }, "windowSize": { "type": "String", @@ -167,7 +167,7 @@ "displayName": "Threshold", "description": "Threshold for the alert" }, - "defaultValue": "50" + "defaultValue": "30" }, "failingPeriods": { "type": "String", @@ -188,24 +188,13 @@ "computersToInclude": { "type": "array", "metadata": { - "displayName": "Disks to be included to be monitored", + "displayName": "Computers to be included to be monitored", "description": "Array of Computer to be monitored" }, "defaultValue": [ "*" ] }, - "disksToInclude": { - "type": "array", - "metadata": { - "displayName": "Disks to be included to be monitored", - "description": "Array of disk to be monitored for disk both windows and linux" - }, - "defaultValue": [ - "C:", - "/" - ] - }, "effect": { "type": "String", "metadata": { @@ -217,6 +206,27 @@ "disabled" ], "defaultValue": "deployIfNotExists" + }, + "MonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name to disable monitoring. Set to true if monitoring should be disabled" + }, + "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -225,6 +235,10 @@ { "field": "type", "equals": "Microsoft.HybridCompute/machines" + }, + { + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -235,43 +249,39 @@ "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c" ], "type": "Microsoft.Insights/scheduledQueryRules", - "existenceScope": "resourcegroup", + "existenceScope": "resourceGroup", "resourceGroupName": "[[parameters('alertResourceGroupName')]", "deploymentScope": "subscription", "existenceCondition": { "allOf": [ { "field": "Microsoft.Insights/scheduledQueryRules/displayName", - "equals": "[[concat(subscription().displayName, '-HybridVMLowOSDiskwriteLatencyAlert')]" + "equals": "[[concat(subscription().displayName, '-HybridVMHighOSDiskWriteLatencyAlert')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/scopes[*]", + "field": "Microsoft.Insights/scheduledQueryRules/scopes[*]", "equals": "[[subscription().id]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/enabled", + "field": "Microsoft.Insights/scheduledQueryRules/enabled", "equals": "[[parameters('enabled')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/evaluationFrequency", + "field": "Microsoft.Insights/scheduledQueryRules/evaluationFrequency", "equals": "[[parameters('evaluationFrequency')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/windowSize", + "field": "Microsoft.Insights/scheduledQueryRules/windowSize", "equals": "[[parameters('windowSize')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/severity", + "field": "Microsoft.Insights/scheduledQueryRules/severity", "equals": "[[parameters('severity')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/autoMitigate", + "field": "Microsoft.Insights/scheduledQueryRules/autoMitigate", "equals": "[[parameters('autoMitigate')]" }, - { - "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold", - "equals": "[[parameters('threshold')]" - }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator", "equals": "[[parameters('operator')]" @@ -290,7 +300,11 @@ }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query", - "equals": "InsightsMetrics| where Origin == \"vm.azm.ms\"| where Namespace == \"LogicalDisk\" and Name == \"WriteLatencyMs\"| extend Disk=tostring(todynamic(Tags)[\"vm.azm.ms/mountId\"])| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk" + "equals": "[[format('let policyThresholdString = \"{2}\"; let excludedResources = (arg(\"\").resources | where type =~ \"Microsoft.HybridCompute/machines\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\"{1}\")); let overridenResource = (arg(\"\").resources | where type == \"microsoft.hybridcompute/machines\" | project _ResourceId = tolower(id), tags | where tags contains \"_amba-WriteLatencyMs-OS-threshold-override_\"); InsightsMetrics | where _ResourceId has \"Microsoft.HybridCompute/machines\" | where _ResourceId !in~ (excludedResources) | where Origin == \"vm.azm.ms\" | where Namespace == \"LogicalDisk\" and Name == \"WriteLatencyMs\" | extend Disk=tostring(todynamic(Tags)[\"vm.azm.ms/mountId\"]) | where Disk in (\"C:\",\"/\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \"_amba-WriteLatencyMs-OS-threshold-override_\", tostring(tags.[\"_amba-WriteLatencyMs-OS-threshold-override_\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'), parameters('threshold'))]" + }, + { + "field": "identity.userAssignedIdentities", + "containsKey": "[[parameters('UAMIResourceId')]" } ] }, @@ -311,6 +325,9 @@ "alertResourceGroupLocation": { "type": "string" }, + "UAMIResourceId": { + "type": "string" + }, "severity": { "type": "String" }, @@ -347,11 +364,14 @@ "evaluationPeriods": { "type": "String" }, - "disksToInclude": { - "type": "array" - }, "computersToInclude": { "type": "array" + }, + "MonitorDisableTagName": { + "type": "String" + }, + "MonitorDisableTagValues": { + "type": "Array" } }, "variables": {}, @@ -366,7 +386,7 @@ { "type": "Microsoft.Resources/deployments", "apiVersion": "2019-10-01", - "name": "VMOSDiskwriteLatencyAlert", + "name": "HybridVMOSDiskwriteLatencyAlert", "resourceGroup": "[[parameters('alertResourceGroupName')]", "dependsOn": [ "[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]" @@ -385,6 +405,9 @@ }, "alertResourceGroupLocation": { "type": "string" + }, + "UAMIResourceId": { + "type": "string" } }, "variables": {}, @@ -392,13 +415,19 @@ { "type": "Microsoft.Insights/scheduledQueryRules", "apiVersion": "2022-08-01-preview", - "name": "[[concat(subscription().displayName, '-HybridVMLowOSDiskwriteLatencyAlert')]", + "name": "[[concat(subscription().displayName, '-HybridVMHighOSDiskWriteLatencyAlert')]", "location": "[[parameters('alertResourceGroupLocation')]", + "identity": { + "type": "UserAssigned", + "userAssignedIdentities": { + "[[parameters('UAMIResourceId')]": {} + } + }, "tags": { "_deployed_by_amba": true }, "properties": { - "displayName": "[[concat(subscription().displayName, '-HybridVMLowOSDiskwriteLatencyAlert')]", + "displayName": "[[concat(subscription().displayName, '-HybridVMHighOSDiskWriteLatencyAlert')]", "description": "Log Alert for Virtual Machine OSDiskwriteLatency", "severity": "[[parameters('severity')]", "enabled": "[[parameters('enabled')]", @@ -413,9 +442,8 @@ "criteria": { "allOf": [ { - "query": "InsightsMetrics| where Origin == \"vm.azm.ms\"| where Namespace == \"LogicalDisk\" and Name == \"WriteLatencyMs\"| extend Disk=tostring(todynamic(Tags)[\"vm.azm.ms/mountId\"])| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk", - "metricMeasureColumn": "AggregatedValue", - "threshold": "[[parameters('threshold')]", + "query": "[[format('let policyThresholdString = \"{2}\"; let excludedResources = (arg(\"\").resources | where type =~ \"Microsoft.HybridCompute/machines\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\"{1}\")); let overridenResource = (arg(\"\").resources | where type == \"microsoft.hybridcompute/machines\" | project _ResourceId = tolower(id), tags | where tags contains \"_amba-WriteLatencyMs-OS-threshold-override_\"); InsightsMetrics | where _ResourceId has \"Microsoft.HybridCompute/machines\" | where _ResourceId !in~ (excludedResources) | where Origin == \"vm.azm.ms\" | where Namespace == \"LogicalDisk\" and Name == \"WriteLatencyMs\" | extend Disk=tostring(todynamic(Tags)[\"vm.azm.ms/mountId\"]) | where Disk in (\"C:\",\"/\") | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId, Disk | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \"_amba-WriteLatencyMs-OS-threshold-override_\", tostring(tags.[\"_amba-WriteLatencyMs-OS-threshold-override_\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, Disk, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'), parameters('threshold'))]", + "threshold": 0, "operator": "[[parameters('operator')]", "resourceIdColumn": "_ResourceId", "timeAggregation": "[[parameters('timeAggregation')]", @@ -428,7 +456,9 @@ { "name": "Disk", "operator": "Include", - "values": "[[parameters('disksToInclude')]" + "values": [ + "*" + ] } ], "failingPeriods": { @@ -450,6 +480,9 @@ "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" + }, "severity": { "value": "[[parameters('severity')]" }, @@ -480,11 +513,14 @@ "evaluationPeriods": { "value": "[[parameters('evaluationPeriods')]" }, - "disksToInclude": { - "value": "[[parameters('disksToInclude')]" - }, "computersToInclude": { "value": "[[parameters('computersToInclude')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('MonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('MonitorDisableTagValues')]" } } } @@ -500,6 +536,9 @@ }, "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" + }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" } } } @@ -516,6 +555,9 @@ "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" + }, "severity": { "value": "[[parameters('severity')]" }, @@ -552,11 +594,14 @@ "evaluationPeriods": { "value": "[[parameters('evaluationPeriods')]" }, - "disksToInclude": { - "value": "[[parameters('disksToInclude')]" - }, "computersToInclude": { "value": "[[parameters('computersToInclude')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('MonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('MonitorDisableTagValues')]" } } } diff --git a/services/HybridCompute/machines/Deploy-Hybrid-VM-PercentCPU-Alert.json b/services/HybridCompute/machines/Deploy-Hybrid-VM-PercentCPU-Alert.json index 8e1484681..2ff04a3ee 100644 --- a/services/HybridCompute/machines/Deploy-Hybrid-VM-PercentCPU-Alert.json +++ b/services/HybridCompute/machines/Deploy-Hybrid-VM-PercentCPU-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy Hybrid VM CPU Alert", "description": "Policy to audit/deploy VM CPU Alert", "metadata": { - "version": "1.0.1", + "version": "1.2.0", "category": "Hybrid Compute", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -23,7 +23,7 @@ "displayName": "Resource Group Name", "description": "Resource group the alert is placed in" }, - "defaultValue": "AlzMonitoring-rg" + "defaultValue": "rg-amba-monitoring-001" }, "alertResourceGroupTags": { "type": "Object", @@ -32,7 +32,7 @@ "description": "Tags on the Resource group the alert is placed in" }, "defaultValue": { - "environment": "test" + "Project": "amba-monitoring" } }, "alertResourceGroupLocation": { @@ -43,6 +43,14 @@ }, "defaultValue": "centralus" }, + "UAMIResourceId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "The resource Id of the user assigned managed identity.", + "displayName": "User Assigned managed Identity resource Id." + } + }, "severity": { "type": "String", "metadata": { @@ -64,11 +72,7 @@ "displayName": "Operator" }, "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" + "GreaterThan" ], "defaultValue": "GreaterThan" }, @@ -78,13 +82,9 @@ "displayName": "TimeAggregation" }, "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" + "Count" ], - "defaultValue": "Average" + "defaultValue": "Count" }, "windowSize": { "type": "String", @@ -177,6 +177,14 @@ }, "defaultValue": "1" }, + "evaluationPeriods": { + "type": "String", + "metadata": { + "displayName": "Evaluation Periods", + "description": "The number of aggregated lookback points." + }, + "defaultValue": "1" + }, "effect": { "type": "String", "metadata": { @@ -188,6 +196,27 @@ "disabled" ], "defaultValue": "deployIfNotExists" + }, + "MonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name to disable monitoring. Set to true if monitoring should be disabled" + }, + "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -196,6 +225,10 @@ { "field": "type", "equals": "Microsoft.HybridCompute/machines" + }, + { + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -206,7 +239,7 @@ "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c" ], "type": "Microsoft.Insights/scheduledQueryRules", - "existenceScope": "resourcegroup", + "existenceScope": "resourceGroup", "resourceGroupName": "[[parameters('alertResourceGroupName')]", "deploymentScope": "subscription", "existenceCondition": { @@ -216,33 +249,29 @@ "equals": "[[concat(subscription().displayName, '-HybridVMHighCPUAlert')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/scopes[*]", + "field": "Microsoft.Insights/scheduledQueryRules/scopes[*]", "equals": "[[subscription().id]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/enabled", + "field": "Microsoft.Insights/scheduledQueryRules/enabled", "equals": "[[parameters('enabled')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/evaluationFrequency", + "field": "Microsoft.Insights/scheduledQueryRules/evaluationFrequency", "equals": "[[parameters('evaluationFrequency')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/windowSize", + "field": "Microsoft.Insights/scheduledQueryRules/windowSize", "equals": "[[parameters('windowSize')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/severity", + "field": "Microsoft.Insights/scheduledQueryRules/severity", "equals": "[[parameters('severity')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/autoMitigate", + "field": "Microsoft.Insights/scheduledQueryRules/autoMitigate", "equals": "[[parameters('autoMitigate')]" }, - { - "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold", - "equals": "[[parameters('threshold')]" - }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator", "equals": "[[parameters('operator')]" @@ -253,7 +282,7 @@ }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods", - "equals": "1" + "equals": "[[parameters('evaluationPeriods')]" }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert", @@ -261,7 +290,11 @@ }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query", - "equals": "InsightsMetrics| where Origin == \"vm.azm.ms\"| where Namespace == \"Processor\" and Name == \"UtilizationPercentage\"| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId" + "equals": "[[format('let policyThresholdString = \"{2}\"; let excludedResources = (arg(\"\").resources | where type =~ \"Microsoft.HybridCompute/machines\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\"{1}\")); let overridenResource = (arg(\"\").resources | where type == \"microsoft.hybridcompute/machines\" | project _ResourceId = tolower(id), tags | where tags contains \"_amba-UtilizationPercentage-threshold-override_\"); InsightsMetrics | where _ResourceId has \"Microsoft.HybridCompute/machines\" | where _ResourceId !in~ (excludedResources) | where Origin == \"vm.azm.ms\" | where Namespace == \"Processor\" and Name == \"UtilizationPercentage\" | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \"_amba-UtilizationPercentage-threshold-override_\", tostring(tags.[\"_amba-UtilizationPercentage-threshold-override_\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'), parameters('threshold'))]" + }, + { + "field": "identity.userAssignedIdentities", + "containsKey": "[[parameters('UAMIResourceId')]" } ] }, @@ -282,6 +315,9 @@ "alertResourceGroupLocation": { "type": "string" }, + "UAMIResourceId": { + "type": "string" + }, "severity": { "type": "String" }, @@ -314,6 +350,15 @@ }, "failingPeriods": { "type": "String" + }, + "evaluationPeriods": { + "type": "String" + }, + "MonitorDisableTagName": { + "type": "String" + }, + "MonitorDisableTagValues": { + "type": "Array" } }, "variables": {}, @@ -328,7 +373,7 @@ { "type": "Microsoft.Resources/deployments", "apiVersion": "2019-10-01", - "name": "VMCPUAlert", + "name": "HybridVMCPUAlert", "resourceGroup": "[[parameters('alertResourceGroupName')]", "dependsOn": [ "[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]" @@ -347,6 +392,9 @@ }, "alertResourceGroupLocation": { "type": "string" + }, + "UAMIResourceId": { + "type": "string" } }, "variables": {}, @@ -356,6 +404,12 @@ "apiVersion": "2022-08-01-preview", "name": "[[concat(subscription().displayName, '-HybridVMHighCPUAlert')]", "location": "[[parameters('alertResourceGroupLocation')]", + "identity": { + "type": "UserAssigned", + "userAssignedIdentities": { + "[[parameters('UAMIResourceId')]": {} + } + }, "tags": { "_deployed_by_amba": true }, @@ -375,9 +429,8 @@ "criteria": { "allOf": [ { - "query": "InsightsMetrics| where Origin == \"vm.azm.ms\"| where Namespace == \"Processor\" and Name == \"UtilizationPercentage\"| summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId", - "metricMeasureColumn": "AggregatedValue", - "threshold": "[[parameters('threshold')]", + "query": "[[format('let policyThresholdString = \"{2}\"; let excludedResources = (arg(\"\").resources | where type =~ \"Microsoft.HybridCompute/machines\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\"{1}\")); let overridenResource = (arg(\"\").resources | where type == \"microsoft.hybridcompute/machines\" | project _ResourceId = tolower(id), tags | where tags contains \"_amba-UtilizationPercentage-threshold-override_\"); InsightsMetrics | where _ResourceId has \"Microsoft.HybridCompute/machines\" | where _ResourceId !in~ (excludedResources) | where Origin == \"vm.azm.ms\" | where Namespace == \"Processor\" and Name == \"UtilizationPercentage\" | summarize AggregatedValue = avg(Val) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \"_amba-UtilizationPercentage-threshold-override_\", tostring(tags.[\"_amba-UtilizationPercentage-threshold-override_\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue > appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'), parameters('threshold'))]", + "threshold": 0, "operator": "[[parameters('operator')]", "resourceIdColumn": "_ResourceId", "timeAggregation": "[[parameters('timeAggregation')]", @@ -391,7 +444,7 @@ } ], "failingPeriods": { - "numberOfEvaluationPeriods": "1", + "numberOfEvaluationPeriods": "[[parameters('evaluationPeriods')]", "minFailingPeriodsToAlert": "[[parameters('failingPeriods')]" } } @@ -409,6 +462,9 @@ "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" + }, "severity": { "value": "[[parameters('severity')]" }, @@ -435,6 +491,15 @@ }, "failingPeriods": { "value": "[[parameters('failingPeriods')]" + }, + "evaluationPeriods": { + "value": "[[parameters('evaluationPeriods')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('MonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('MonitorDisableTagValues')]" } } } @@ -450,6 +515,9 @@ }, "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" + }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" } } } @@ -466,6 +534,9 @@ "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" + }, "severity": { "value": "[[parameters('severity')]" }, @@ -498,6 +569,15 @@ }, "failingPeriods": { "value": "[[parameters('failingPeriods')]" + }, + "evaluationPeriods": { + "value": "[[parameters('evaluationPeriods')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('MonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('MonitorDisableTagValues')]" } } } diff --git a/services/HybridCompute/machines/Deploy-Hybrid-VM-PercentMemory-Alert.json b/services/HybridCompute/machines/Deploy-Hybrid-VM-PercentMemory-Alert.json index d5df9d61e..01c464f51 100644 --- a/services/HybridCompute/machines/Deploy-Hybrid-VM-PercentMemory-Alert.json +++ b/services/HybridCompute/machines/Deploy-Hybrid-VM-PercentMemory-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy Hybrid VM Memory Alert", "description": "Policy to audit/deploy VM Memory Alert", "metadata": { - "version": "1.0.1", + "version": "1.2.0", "category": "Hybrid Compute", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -23,7 +23,7 @@ "displayName": "Resource Group Name", "description": "Resource group the alert is placed in" }, - "defaultValue": "AlzMonitoring-rg" + "defaultValue": "rg-amba-monitoring-001" }, "alertResourceGroupTags": { "type": "Object", @@ -32,7 +32,7 @@ "description": "Tags on the Resource group the alert is placed in" }, "defaultValue": { - "environment": "test" + "Project": "amba-monitoring" } }, "alertResourceGroupLocation": { @@ -43,6 +43,14 @@ }, "defaultValue": "centralus" }, + "UAMIResourceId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "The resource Id of the user assigned managed identity.", + "displayName": "User Assigned managed Identity resource Id." + } + }, "severity": { "type": "String", "metadata": { @@ -64,13 +72,9 @@ "displayName": "Operator" }, "allowedValues": [ - "Equals", - "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" + "GreaterThan" ], - "defaultValue": "LessThan" + "defaultValue": "GreaterThan" }, "timeAggregation": { "type": "String", @@ -78,13 +82,9 @@ "displayName": "TimeAggregation" }, "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" + "Count" ], - "defaultValue": "Average" + "defaultValue": "Count" }, "windowSize": { "type": "String", @@ -196,6 +196,27 @@ "disabled" ], "defaultValue": "deployIfNotExists" + }, + "MonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name to disable monitoring. Set to true if monitoring should be disabled" + }, + "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -204,6 +225,10 @@ { "field": "type", "equals": "Microsoft.HybridCompute/machines" + }, + { + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -214,7 +239,7 @@ "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c" ], "type": "Microsoft.Insights/scheduledQueryRules", - "existenceScope": "resourcegroup", + "existenceScope": "resourceGroup", "resourceGroupName": "[[parameters('alertResourceGroupName')]", "deploymentScope": "subscription", "existenceCondition": { @@ -224,33 +249,29 @@ "equals": "[[concat(subscription().displayName, '-HybridVMLowMemoryAlert')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/scopes[*]", + "field": "Microsoft.Insights/scheduledQueryRules/scopes[*]", "equals": "[[subscription().id]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/enabled", + "field": "Microsoft.Insights/scheduledQueryRules/enabled", "equals": "[[parameters('enabled')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/evaluationFrequency", + "field": "Microsoft.Insights/scheduledQueryRules/evaluationFrequency", "equals": "[[parameters('evaluationFrequency')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/windowSize", + "field": "Microsoft.Insights/scheduledQueryRules/windowSize", "equals": "[[parameters('windowSize')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/severity", + "field": "Microsoft.Insights/scheduledQueryRules/severity", "equals": "[[parameters('severity')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/autoMitigate", + "field": "Microsoft.Insights/scheduledQueryRules/autoMitigate", "equals": "[[parameters('autoMitigate')]" }, - { - "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].threshold", - "equals": "[[parameters('threshold')]" - }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].operator", "equals": "[[parameters('operator')]" @@ -269,7 +290,11 @@ }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query", - "equals": "InsightsMetrics| where Origin == \"vm.azm.ms\"|where Namespace == \"Memory\" and Name == \"AvailableMB\"| extend TotalMemory = toreal(todynamic(Tags)[\"vm.azm.ms/memorySizeMB\"]) | extend AvailableMemoryPercentage = (toreal(Val) / TotalMemory) * 100.0| summarize AggregatedValue = avg(AvailableMemoryPercentage) by bin(TimeGenerated, 15m), Computer, _ResourceId" + "equals": "[[format('let policyThresholdString = \"{2}\"; let excludedResources = (arg(\"\").resources | where type =~ \"Microsoft.HybridCompute/machines\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\"{1}\")); let overridenResource = (arg(\"\").resources | where type == \"microsoft.hybridcompute/machines\" | project _ResourceId = tolower(id), tags | where tags contains \"_amba-AvailableMemoryPercentage-threshold-override_\"); InsightsMetrics | where _ResourceId has \"Microsoft.HybridCompute/machines\" | where _ResourceId !in~ (excludedResources) | where Origin == \"vm.azm.ms\" | where Namespace == \"Memory\" and Name == \"AvailableMB\" | extend TotalMemory = toreal(todynamic(Tags)[\"vm.azm.ms/memorySizeMB\"]) | extend AvailableMemoryPercentage = (toreal(Val) / TotalMemory) * 100.0 | summarize AggregatedValue = avg(AvailableMemoryPercentage) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \"_amba-AvailableMemoryPercentage-threshold-override_\", tostring(tags.[\"_amba-AvailableMemoryPercentage-threshold-override_\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'), parameters('threshold'))]" + }, + { + "field": "identity.userAssignedIdentities", + "containsKey": "[[parameters('UAMIResourceId')]" } ] }, @@ -290,6 +315,9 @@ "alertResourceGroupLocation": { "type": "string" }, + "UAMIResourceId": { + "type": "string" + }, "severity": { "type": "String" }, @@ -325,6 +353,12 @@ }, "evaluationPeriods": { "type": "String" + }, + "MonitorDisableTagName": { + "type": "String" + }, + "MonitorDisableTagValues": { + "type": "Array" } }, "variables": {}, @@ -339,7 +373,7 @@ { "type": "Microsoft.Resources/deployments", "apiVersion": "2019-10-01", - "name": "VMMemoryAlert", + "name": "HybridVMMemoryAlert", "resourceGroup": "[[parameters('alertResourceGroupName')]", "dependsOn": [ "[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]" @@ -358,6 +392,9 @@ }, "alertResourceGroupLocation": { "type": "string" + }, + "UAMIResourceId": { + "type": "string" } }, "variables": {}, @@ -367,6 +404,12 @@ "apiVersion": "2022-08-01-preview", "name": "[[concat(subscription().displayName, '-HybridVMLowMemoryAlert')]", "location": "[[parameters('alertResourceGroupLocation')]", + "identity": { + "type": "UserAssigned", + "userAssignedIdentities": { + "[[parameters('UAMIResourceId')]": {} + } + }, "tags": { "_deployed_by_amba": true }, @@ -386,9 +429,8 @@ "criteria": { "allOf": [ { - "query": "InsightsMetrics| where Origin == \"vm.azm.ms\"|where Namespace == \"Memory\" and Name == \"AvailableMB\"| extend TotalMemory = toreal(todynamic(Tags)[\"vm.azm.ms/memorySizeMB\"]) | extend AvailableMemoryPercentage = (toreal(Val) / TotalMemory) * 100.0| summarize AggregatedValue = avg(AvailableMemoryPercentage) by bin(TimeGenerated, 15m), Computer, _ResourceId", - "metricMeasureColumn": "AggregatedValue", - "threshold": "[[parameters('threshold')]", + "query": "[[format('let policyThresholdString = \"{2}\"; let excludedResources = (arg(\"\").resources | where type =~ \"Microsoft.HybridCompute/machines\" | project _ResourceId = id, tags | where parse_json(tostring(tags.{0})) in~ (\"{1}\")); let overridenResource = (arg(\"\").resources | where type == \"microsoft.hybridcompute/machines\" | project _ResourceId = tolower(id), tags | where tags contains \"_amba-AvailableMemoryPercentage-threshold-override_\"); InsightsMetrics | where _ResourceId has \"Microsoft.HybridCompute/machines\" | where _ResourceId !in~ (excludedResources) | where Origin == \"vm.azm.ms\" | where Namespace == \"Memory\" and Name == \"AvailableMB\" | extend TotalMemory = toreal(todynamic(Tags)[\"vm.azm.ms/memorySizeMB\"]) | extend AvailableMemoryPercentage = (toreal(Val) / TotalMemory) * 100.0 | summarize AggregatedValue = avg(AvailableMemoryPercentage) by bin(TimeGenerated, 15m), Computer, _ResourceId | join hint.remote=left kind=leftouter overridenResource on _ResourceId | project-away _ResourceId1 | extend appliedThresholdString = iif(tags contains \"_amba-AvailableMemoryPercentage-threshold-override_\", tostring(tags.[\"_amba-AvailableMemoryPercentage-threshold-override_\"]), policyThresholdString) | extend appliedThreshold = toint(appliedThresholdString) | where AggregatedValue < appliedThreshold | project TimeGenerated, Computer, _ResourceId, AggregatedValue', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'), parameters('threshold'))]", + "threshold": 0, "operator": "[[parameters('operator')]", "resourceIdColumn": "_ResourceId", "timeAggregation": "[[parameters('timeAggregation')]", @@ -420,6 +462,9 @@ "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" + }, "severity": { "value": "[[parameters('severity')]" }, @@ -449,6 +494,12 @@ }, "evaluationPeriods": { "value": "[[parameters('evaluationPeriods')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('MonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('MonitorDisableTagValues')]" } } } @@ -464,6 +515,9 @@ }, "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" + }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" } } } @@ -480,6 +534,9 @@ "alertResourceGroupLocation": { "value": "[[parameters('alertResourceGroupLocation')]" }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" + }, "severity": { "value": "[[parameters('severity')]" }, @@ -515,6 +572,12 @@ }, "evaluationPeriods": { "value": "[[parameters('evaluationPeriods')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('MonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('MonitorDisableTagValues')]" } } } diff --git a/services/HybridCompute/machines/Deploy-Hybrid-VM-AvailableMemory-Alert.json b/services/HybridCompute/machines/Not_In_Use_Deploy-Hybrid-VM-AvailableMemory-Alert.json similarity index 94% rename from services/HybridCompute/machines/Deploy-Hybrid-VM-AvailableMemory-Alert.json rename to services/HybridCompute/machines/Not_In_Use_Deploy-Hybrid-VM-AvailableMemory-Alert.json index 20c9f4805..422d92bdf 100644 --- a/services/HybridCompute/machines/Deploy-Hybrid-VM-AvailableMemory-Alert.json +++ b/services/HybridCompute/machines/Not_In_Use_Deploy-Hybrid-VM-AvailableMemory-Alert.json @@ -113,9 +113,22 @@ "type": "String", "metadata": { "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "description": "Tag name to disable monitoring on resource. Set to true if monitoring should be disabled" }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -127,7 +140,7 @@ }, { "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, diff --git a/services/HybridCompute/machines/Deploy-Hybrid-VM-HeartBeatAlertRG.json b/services/HybridCompute/machines/Not_In_Use_Deploy-Hybrid-VM-HeartBeatAlertRG.json similarity index 95% rename from services/HybridCompute/machines/Deploy-Hybrid-VM-HeartBeatAlertRG.json rename to services/HybridCompute/machines/Not_In_Use_Deploy-Hybrid-VM-HeartBeatAlertRG.json index a3cebca00..4540422e2 100644 --- a/services/HybridCompute/machines/Deploy-Hybrid-VM-HeartBeatAlertRG.json +++ b/services/HybridCompute/machines/Not_In_Use_Deploy-Hybrid-VM-HeartBeatAlertRG.json @@ -8,7 +8,7 @@ "displayName": "Deploy Hybrid VM HeartBeat Alert", "description": "Policy to audit/deploy VM HeartBeat Alert for VMs in the resource group", "metadata": { - "version": "1.0.1", + "version": "1.0.0", "category": "Hybrid Compute", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -37,14 +37,14 @@ "metadata": { "displayName": "Operator" }, - "allowedValues": [ + "allowedvalues": [ "Equals", "GreaterThan", "GreaterThanOrEqual", "LessThan", "LessThanOrEqual" ], - "defaultValue": "GreaterThan" + "defaultvalue": "GreaterThan" }, "timeAggregation": { "type": "String", @@ -58,7 +58,7 @@ "Minimum", "Total" ], - "defaultValue": "Average" + "defaultvalue": "Average" }, "windowSize": { "type": "String", @@ -159,9 +159,22 @@ "type": "String", "metadata": { "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "description": "Tag name to disable monitoring on resource. Set to true if monitoring should be disabled" }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -173,7 +186,7 @@ }, { "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, diff --git a/services/KeyVault/managedHSMs/Deploy-ActivityLog-HSMs-Del.json b/services/KeyVault/managedHSMs/Deploy-ActivityLog-HSMs-Del.json new file mode 100644 index 000000000..5291bfe09 --- /dev/null +++ b/services/KeyVault/managedHSMs/Deploy-ActivityLog-HSMs-Del.json @@ -0,0 +1,284 @@ +{ + "type": "Microsoft.Authorization/policyDefinitions", + "apiVersion": "2021-06-01", + "name": "Deploy_ActivityLog_ManagedHSMs_Delete", + "properties": { + "policyType": "Custom", + "mode": "All", + "displayName": "Deploy Activity Log Managed HSMs Delete Alert", + "description": "Policy to Deploy Activity Log Managed HSMs Delete Alert", + "metadata": { + "version": "1.0.0", + "category": "Key Vault", + "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", + "alzCloudEnvironments": [ + "AzureCloud" + ], + "_deployed_by_amba": "True" + }, + "parameters": { + "enabled": { + "type": "String", + "metadata": { + "displayName": "Alert State", + "description": "Alert state for the alert" + }, + "allowedValues": [ + "true", + "false" + ], + "defaultValue": "true" + }, + "alertResourceGroupName": { + "type": "String", + "metadata": { + "displayName": "Resource Group Name", + "description": "Resource group the alert is placed in" + }, + "defaultValue": "rg-amba-monitoring-001" + }, + "alertResourceGroupTags": { + "type": "Object", + "metadata": { + "displayName": "Resource Group Tags", + "description": "Tags on the Resource group the alert is placed in" + }, + "defaultValue": { + "_deployed_by_amba": true + } + }, + "alertResourceGroupLocation": { + "type": "String", + "metadata": { + "displayName": "Resource Group Location", + "description": "Location of the Resource group the alert is placed in" + }, + "defaultValue": "centralus" + }, + "effect": { + "type": "String", + "metadata": { + "displayName": "Effect", + "description": "Effect of the policy" + }, + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "defaultValue": "deployIfNotExists" + }, + "MonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] + } + }, + "policyRule": { + "if": { + "allOf": [ + { + "field": "type", + "equals": "microsoft.keyvault/managedHSMs" + }, + { + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" + } + ] + }, + "then": { + "effect": "[[parameters('effect')]", + "details": { + "roleDefinitionIds": [ + "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c" + ], + "type": "Microsoft.Insights/activityLogAlerts", + "name": "ActivityManagedHSMDelete", + "existenceScope": "resourcegroup", + "resourceGroupName": "[[parameters('alertResourceGroupName')]", + "deploymentScope": "subscription", + "existenceCondition": { + "allOf": [ + { + "field": "Microsoft.Insights/ActivityLogAlerts/enabled", + "equals": "[[parameters('enabled')]" + }, + { + "count": { + "field": "Microsoft.Insights/ActivityLogAlerts/condition.allOf[*]", + "where": { + "anyOf": [ + { + "allOf": [ + { + "field": "Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].field", + "equals": "category" + }, + { + "field": "Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].equals", + "equals": "Administrative" + } + ] + }, + { + "allOf": [ + { + "field": "microsoft.insights/activityLogAlerts/condition.allOf[*].field", + "equals": "operationName" + }, + { + "field": "microsoft.insights/activityLogAlerts/condition.allOf[*].equals", + "equals": "Microsoft.KeyVault/ManagedHSMs/delete" + } + ] + } + ] + } + }, + "equals": 2 + } + ] + }, + "deployment": { + "location": "northeurope", + "properties": { + "mode": "incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "alertResourceGroupName": { + "type": "string" + }, + "alertResourceGroupTags": { + "type": "object" + }, + "alertResourceGroupLocation": { + "type": "string" + }, + "enabled": { + "type": "string" + } + }, + "variables": {}, + "resources": [ + { + "type": "Microsoft.Resources/resourceGroups", + "apiVersion": "2021-04-01", + "name": "[[parameters('alertResourceGroupName')]", + "location": "[[parameters('alertResourceGroupLocation')]", + "tags": "[[parameters('alertResourceGroupTags')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2019-10-01", + "name": "ActivityManagedHSMDelete", + "resourceGroup": "[[parameters('alertResourceGroupName')]", + "dependsOn": [ + "[[concat('Microsoft.Resources/resourceGroups/', parameters('alertResourceGroupName'))]" + ], + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "enabled": { + "type": "string" + }, + "alertResourceGroupName": { + "type": "string" + } + }, + "variables": {}, + "resources": [ + { + "type": "microsoft.insights/activityLogAlerts", + "apiVersion": "2020-10-01", + "name": "ActivityManagedHSMDelete", + "location": "global", + "tags": { + "_deployed_by_amba": true + }, + "properties": { + "description": "Activity Log Managed HSM Delete", + "enabled": "[[parameters('enabled')]", + "scopes": [ + "[[subscription().id]" + ], + "condition": { + "allOf": [ + { + "field": "category", + "equals": "Administrative" + }, + { + "field": "operationName", + "equals": "Microsoft.KeyVault/managedHSMs/delete" + }, + { + "field": "status", + "containsAny": [ + "succeeded" + ] + } + ] + }, + "parameters": { + "enabled": { + "value": "[[parameters('enabled')]" + } + } + } + } + ] + }, + "parameters": { + "enabled": { + "value": "[[parameters('enabled')]" + }, + "alertResourceGroupName": { + "value": "[[parameters('alertResourceGroupName')]" + } + } + } + } + ] + }, + "parameters": { + "enabled": { + "value": "[[parameters('enabled')]" + }, + "alertResourceGroupName": { + "value": "[[parameters('alertResourceGroupName')]" + }, + "alertResourceGroupTags": { + "value": "[[parameters('alertResourceGroupTags')]" + }, + "alertResourceGroupLocation": { + "value": "[[parameters('alertResourceGroupLocation')]" + } + } + } + } + } + } + } + } +} diff --git a/services/KeyVault/managedHSMs/Deploy-HSMs-Availability-Alert.json b/services/KeyVault/managedHSMs/Deploy-HSMs-Availability-Alert.json new file mode 100644 index 000000000..2b7a5757a --- /dev/null +++ b/services/KeyVault/managedHSMs/Deploy-HSMs-Availability-Alert.json @@ -0,0 +1,332 @@ +{ + "type": "Microsoft.Authorization/policyDefinitions", + "apiVersion": "2021-06-01", + "name": "Deploy_ManagedHSMs_Availability_Alert", + "properties": { + "policyType": "Custom", + "mode": "All", + "displayName": "Deploy Managed HSMs Availability Alert", + "description": "Policy to audit/deploy Managed HSMs Availability Alert", + "metadata": { + "version": "1.0.0", + "category": "Key Vault", + "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", + "alzCloudEnvironments": [ + "AzureCloud" + ], + "_deployed_by_amba": "True" + }, + "parameters": { + "severity": { + "type": "String", + "metadata": { + "displayName": "Severity", + "description": "Severity of the Alert" + }, + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "defaultValue": "1" + }, + "windowSize": { + "type": "String", + "metadata": { + "displayName": "Window Size", + "description": "Window size for the alert" + }, + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "defaultValue": "PT5M" + }, + "evaluationFrequency": { + "type": "String", + "metadata": { + "displayName": "Evaluation Frequency", + "description": "Evaluation frequency for the alert" + }, + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "defaultValue": "PT1M" + }, + "autoMitigate": { + "type": "String", + "metadata": { + "displayName": "Auto Mitigate", + "description": "Auto Mitigate for the alert" + }, + "allowedValues": [ + "true", + "false" + ], + "defaultValue": "true" + }, + "enabled": { + "type": "String", + "metadata": { + "displayName": "Alert State", + "description": "Alert state for the alert" + }, + "allowedValues": [ + "true", + "false" + ], + "defaultValue": "true" + }, + "threshold": { + "type": "String", + "metadata": { + "displayName": "Threshold", + "description": "Threshold for the alert" + }, + "defaultValue": "90" + }, + "effect": { + "type": "String", + "metadata": { + "displayName": "Effect", + "description": "Effect of the policy" + }, + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "defaultValue": "disabled" + }, + "MonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] + } + }, + "policyRule": { + "if": { + "allOf": [ + { + "field": "type", + "equals": "microsoft.keyvault/managedHSMs" + }, + { + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" + } + ] + }, + "then": { + "effect": "[[parameters('effect')]", + "details": { + "roleDefinitionIds": [ + "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c" + ], + "type": "Microsoft.Insights/metricAlerts", + "existenceCondition": { + "allOf": [ + { + "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace", + "equals": "Microsoft.KeyVault/ManagedHSMs" + }, + { + "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName", + "equals": "Availability" + }, + { + "field": "Microsoft.Insights/metricalerts/scopes[*]", + "equals": "[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/microsoft.keyvault/managedHSMs/', field('fullName'))]" + }, + { + "field": "Microsoft.Insights/metricAlerts/enabled", + "equals": "[[parameters('enabled')]" + }, + { + "field": "Microsoft.Insights/metricAlerts/evaluationFrequency", + "equals": "[[parameters('evaluationFrequency')]" + }, + { + "field": "Microsoft.Insights/metricAlerts/windowSize", + "equals": "[[parameters('windowSize')]" + }, + { + "field": "Microsoft.Insights/metricalerts/severity", + "equals": "[[parameters('severity')]" + }, + { + "field": "Microsoft.Insights/metricAlerts/autoMitigate", + "equals": "[[parameters('autoMitigate')]" + }, + { + "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation", + "equals": "Average" + }, + { + "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator", + "equals": "LessThan" + }, + { + "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold", + "equals": "[[if(contains(field('tags'), '_amba-Availability-threshold-Override_'), field('tags._amba-Availability-threshold-Override_'), parameters('threshold'))]" + } + ] + }, + "deployment": { + "properties": { + "mode": "incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "resourceName": { + "type": "String", + "metadata": { + "displayName": "resourceName", + "description": "Name of the resource" + } + }, + "resourceId": { + "type": "String", + "metadata": { + "displayName": "resourceId", + "description": "Resource ID of the resource emitting the metric that will be used for the comparison" + } + }, + "severity": { + "type": "String" + }, + "windowSize": { + "type": "String" + }, + "evaluationFrequency": { + "type": "String" + }, + "autoMitigate": { + "type": "String" + }, + "enabled": { + "type": "String" + }, + "threshold": { + "type": "String" + } + }, + "variables": {}, + "resources": [ + { + "type": "Microsoft.Insights/metricAlerts", + "apiVersion": "2018-03-01", + "name": "[[concat(parameters('resourceName'), '-Availability')]", + "location": "global", + "tags": { + "_deployed_by_amba": true + }, + "properties": { + "description": "Metric Alert for ManagedHSM Availability", + "severity": "[[parameters('severity')]", + "enabled": "[[parameters('enabled')]", + "scopes": [ + "[[parameters('resourceId')]" + ], + "evaluationFrequency": "[[parameters('evaluationFrequency')]", + "windowSize": "[[parameters('windowSize')]", + "criteria": { + "allOf": [ + { + "name": "Availability", + "metricNamespace": "microsoft.keyvault/managedHSMs", + "metricName": "Availability", + "operator": "LessThan", + "threshold": "[[parameters('threshold')]", + "timeAggregation": "Average", + "criterionType": "StaticThresholdCriterion" + } + ], + "odata.type": "Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria" + }, + "autoMitigate": "[[parameters('autoMitigate')]", + "parameters": { + "severity": { + "value": "[[parameters('severity')]" + }, + "windowSize": { + "value": "[[parameters('windowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('evaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[parameters('autoMitigate')]" + }, + "enabled": { + "value": "[[parameters('enabled')]" + }, + "threshold": { + "value": "[[parameters('threshold')]" + } + } + } + } + ] + }, + "parameters": { + "resourceName": { + "value": "[[field('name')]" + }, + "resourceId": { + "value": "[[field('id')]" + }, + "severity": { + "value": "[[parameters('severity')]" + }, + "windowSize": { + "value": "[[parameters('windowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('evaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[parameters('autoMitigate')]" + }, + "enabled": { + "value": "[[parameters('enabled')]" + }, + "threshold": { + "value": "[[if(contains(field('tags'), '_amba-Availability-threshold-Override_'), field('tags._amba-Availability-threshold-Override_'), parameters('threshold'))]" + } + } + } + } + } + } + } + } +} diff --git a/services/KeyVault/managedHSMs/Deploy-HSMs-Latency-Alert.json b/services/KeyVault/managedHSMs/Deploy-HSMs-Latency-Alert.json new file mode 100644 index 000000000..4e4e712a9 --- /dev/null +++ b/services/KeyVault/managedHSMs/Deploy-HSMs-Latency-Alert.json @@ -0,0 +1,332 @@ +{ + "type": "Microsoft.Authorization/policyDefinitions", + "apiVersion": "2021-06-01", + "name": "Deploy_ManagedHSMs_Latency_Alert", + "properties": { + "policyType": "Custom", + "mode": "All", + "displayName": "Deploy Managed HSMs Latency Alert", + "description": "Policy to audit/deploy Managed HSMs Latency Alert", + "metadata": { + "version": "1.1.0", + "category": "Key Vault", + "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", + "alzCloudEnvironments": [ + "AzureCloud" + ], + "_deployed_by_amba": "True" + }, + "parameters": { + "severity": { + "type": "String", + "metadata": { + "displayName": "Severity", + "description": "Severity of the Alert" + }, + "allowedValues": [ + "0", + "1", + "2", + "3", + "4" + ], + "defaultValue": "3" + }, + "windowSize": { + "type": "String", + "metadata": { + "displayName": "Window Size", + "description": "Window size for the alert" + }, + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H", + "PT6H", + "PT12H", + "P1D" + ], + "defaultValue": "PT5M" + }, + "evaluationFrequency": { + "type": "String", + "metadata": { + "displayName": "Evaluation Frequency", + "description": "Evaluation frequency for the alert" + }, + "allowedValues": [ + "PT1M", + "PT5M", + "PT15M", + "PT30M", + "PT1H" + ], + "defaultValue": "PT5M" + }, + "autoMitigate": { + "type": "String", + "metadata": { + "displayName": "Auto Mitigate", + "description": "Auto Mitigate for the alert" + }, + "allowedValues": [ + "true", + "false" + ], + "defaultValue": "true" + }, + "enabled": { + "type": "String", + "metadata": { + "displayName": "Alert State", + "description": "Alert state for the alert" + }, + "allowedValues": [ + "true", + "false" + ], + "defaultValue": "true" + }, + "threshold": { + "type": "String", + "metadata": { + "displayName": "Threshold", + "description": "Threshold for the alert" + }, + "defaultValue": "1000" + }, + "effect": { + "type": "String", + "metadata": { + "displayName": "Effect", + "description": "Effect of the policy" + }, + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "defaultValue": "disabled" + }, + "MonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] + } + }, + "policyRule": { + "if": { + "allOf": [ + { + "field": "type", + "equals": "microsoft.keyvault/managedHSMs" + }, + { + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" + } + ] + }, + "then": { + "effect": "[[parameters('effect')]", + "details": { + "roleDefinitionIds": [ + "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c" + ], + "type": "Microsoft.Insights/metricAlerts", + "existenceCondition": { + "allOf": [ + { + "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricNamespace", + "equals": "Microsoft.KeyVault/managedHSMs" + }, + { + "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].metricName", + "equals": "ServiceApiLatency" + }, + { + "field": "Microsoft.Insights/metricalerts/scopes[*]", + "equals": "[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/microsoft.keyvault/managedHSMs', field('fullName'))]" + }, + { + "field": "Microsoft.Insights/metricAlerts/enabled", + "equals": "[[parameters('enabled')]" + }, + { + "field": "Microsoft.Insights/metricAlerts/evaluationFrequency", + "equals": "[[parameters('evaluationFrequency')]" + }, + { + "field": "Microsoft.Insights/metricAlerts/windowSize", + "equals": "[[parameters('windowSize')]" + }, + { + "field": "Microsoft.Insights/metricalerts/severity", + "equals": "[[parameters('severity')]" + }, + { + "field": "Microsoft.Insights/metricAlerts/autoMitigate", + "equals": "[[parameters('autoMitigate')]" + }, + { + "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].timeAggregation", + "equals": "Average" + }, + { + "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.operator", + "equals": "GreaterThan" + }, + { + "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold", + "equals": "[[if(contains(field('tags'), '_amba-ServiceApiLatency-threshold-Override_'), field('tags._amba-ServiceApiLatency-threshold-Override_'), parameters('threshold'))]" + } + ] + }, + "deployment": { + "properties": { + "mode": "incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "resourceName": { + "type": "String", + "metadata": { + "displayName": "resourceName", + "description": "Name of the resource" + } + }, + "resourceId": { + "type": "String", + "metadata": { + "displayName": "resourceId", + "description": "Resource ID of the resource emitting the metric that will be used for the comparison" + } + }, + "severity": { + "type": "String" + }, + "windowSize": { + "type": "String" + }, + "evaluationFrequency": { + "type": "String" + }, + "autoMitigate": { + "type": "String" + }, + "enabled": { + "type": "String" + }, + "threshold": { + "type": "String" + } + }, + "variables": {}, + "resources": [ + { + "type": "Microsoft.Insights/metricAlerts", + "apiVersion": "2018-03-01", + "name": "[[concat(parameters('resourceName'), '-LatencyAlert')]", + "location": "global", + "tags": { + "_deployed_by_amba": true + }, + "properties": { + "description": "Metric Alert for ManagedHSM Latency", + "severity": "[[parameters('severity')]", + "enabled": "[[parameters('enabled')]", + "scopes": [ + "[[parameters('resourceId')]" + ], + "evaluationFrequency": "[[parameters('evaluationFrequency')]", + "windowSize": "[[parameters('windowSize')]", + "criteria": { + "allOf": [ + { + "name": "ServiceApiLatency", + "metricNamespace": "Microsoft.KeyVault/managedHSMs", + "metricName": "ServiceApiLatency", + "operator": "GreaterThan", + "threshold": "[[parameters('threshold')]", + "timeAggregation": "Average", + "criterionType": "StaticThresholdCriterion" + } + ], + "odata.type": "Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria" + }, + "autoMitigate": "[[parameters('autoMitigate')]", + "parameters": { + "severity": { + "value": "[[parameters('severity')]" + }, + "windowSize": { + "value": "[[parameters('windowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('evaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[parameters('autoMitigate')]" + }, + "enabled": { + "value": "[[parameters('enabled')]" + }, + "threshold": { + "value": "[[parameters('threshold')]" + } + } + } + } + ] + }, + "parameters": { + "resourceName": { + "value": "[[field('name')]" + }, + "resourceId": { + "value": "[[field('id')]" + }, + "severity": { + "value": "[[parameters('severity')]" + }, + "windowSize": { + "value": "[[parameters('windowSize')]" + }, + "evaluationFrequency": { + "value": "[[parameters('evaluationFrequency')]" + }, + "autoMitigate": { + "value": "[[parameters('autoMitigate')]" + }, + "enabled": { + "value": "[[parameters('enabled')]" + }, + "threshold": { + "value": "[[if(contains(field('tags'), '_amba-ServiceApiLatency-threshold-Override_'), field('tags._amba-ServiceApiLatency-threshold-Override_'), parameters('threshold'))]" + } + } + } + } + } + } + } + } +} diff --git a/services/KeyVault/vaults/Deploy-ActivityLog-KeyVault-Del.json b/services/KeyVault/vaults/Deploy-ActivityLog-KeyVault-Del.json index 84b2aeb28..6c01f2175 100644 --- a/services/KeyVault/vaults/Deploy-ActivityLog-KeyVault-Del.json +++ b/services/KeyVault/vaults/Deploy-ActivityLog-KeyVault-Del.json @@ -8,7 +8,7 @@ "displayName": "Deploy Activity Log Key Vault Delete Alert", "description": "Policy to Deploy Activity Log Key Vault Delete Alert", "metadata": { - "version": "1.0.1", + "version": "1.1.0", "category": "Key Vault", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -35,7 +35,7 @@ "displayName": "Resource Group Name", "description": "Resource group the alert is placed in" }, - "defaultValue": "AlzMonitoring-rg" + "defaultValue": "rg-amba-monitoring-001" }, "alertResourceGroupTags": { "type": "Object", @@ -44,7 +44,6 @@ "description": "Tags on the Resource group the alert is placed in" }, "defaultValue": { - "environment": "test", "_deployed_by_amba": true } }, @@ -56,13 +55,38 @@ }, "defaultValue": "centralus" }, - "MonitorDisable": { + "effect": { "type": "String", "metadata": { "displayName": "Effect", - "description": "Tag name to disable monitoring on resource. Set to true if monitoring should be disabled" + "description": "Effect of the policy" + }, + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "defaultValue": "deployIfNotExists" + }, + "MonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name to disable monitoring. Set to true if monitoring should be disabled" }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -73,13 +97,13 @@ "equals": "microsoft.keyvault/vaults" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, "then": { - "effect": "deployIfNotExists", + "effect": "[[parameters('effect')]", "details": { "roleDefinitionIds": [ "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c" diff --git a/services/KeyVault/vaults/Deploy-KV-Availability-Alert.json b/services/KeyVault/vaults/Deploy-KV-Availability-Alert.json index f3878819c..3f6f27f2e 100644 --- a/services/KeyVault/vaults/Deploy-KV-Availability-Alert.json +++ b/services/KeyVault/vaults/Deploy-KV-Availability-Alert.json @@ -5,10 +5,10 @@ "properties": { "policyType": "Custom", "mode": "All", - "displayName": "Deploy KeyVault Availability Alert", + "displayName": "Deploy Key Vault Availability Alert", "description": "Policy to audit/deploy KeyVault Availability Alert", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Key Vault", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -109,13 +109,26 @@ ], "defaultValue": "disabled" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -126,8 +139,8 @@ "equals": "microsoft.keyvault/vaults" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -182,7 +195,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-Availability-threshold-Override_'), field('tags._amba-Availability-threshold-Override_'), parameters('threshold'))]" } ] }, @@ -307,7 +320,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-Availability-threshold-Override_'), field('tags._amba-Availability-threshold-Override_'), parameters('threshold'))]" } } } diff --git a/services/KeyVault/vaults/Deploy-KV-Capacity-Alert.json b/services/KeyVault/vaults/Deploy-KV-Capacity-Alert.json index fc96986a0..fe42bdf48 100644 --- a/services/KeyVault/vaults/Deploy-KV-Capacity-Alert.json +++ b/services/KeyVault/vaults/Deploy-KV-Capacity-Alert.json @@ -5,10 +5,10 @@ "properties": { "policyType": "Custom", "mode": "All", - "displayName": "Deploy KeyVault Capacity Alert", + "displayName": "Deploy Key Vault Capacity Alert", "description": "Policy to audit/deploy KeyVault Capacity Alert", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Key Vault", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -109,13 +109,26 @@ ], "defaultValue": "disabled" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -126,8 +139,8 @@ "equals": "microsoft.keyvault/vaults" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -182,7 +195,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-SaturationShoebox-threshold-Override_'), field('tags._amba-SaturationShoebox-threshold-Override_'), parameters('threshold'))]" } ] }, @@ -307,7 +320,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-SaturationShoebox-threshold-Override_'), field('tags._amba-SaturationShoebox-threshold-Override_'), parameters('threshold'))]" } } } diff --git a/services/KeyVault/vaults/Deploy-KV-Latency-Alert.json b/services/KeyVault/vaults/Deploy-KV-Latency-Alert.json index c55b2814e..856f522e6 100644 --- a/services/KeyVault/vaults/Deploy-KV-Latency-Alert.json +++ b/services/KeyVault/vaults/Deploy-KV-Latency-Alert.json @@ -5,10 +5,10 @@ "properties": { "policyType": "Custom", "mode": "All", - "displayName": "Deploy KeyVault Latency Alert", + "displayName": "Deploy Key Vault Latency Alert", "description": "Policy to audit/deploy KeyVault Latency Alert", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Key Vault", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -109,13 +109,26 @@ ], "defaultValue": "disabled" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -126,8 +139,8 @@ "equals": "microsoft.keyvault/vaults" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -182,7 +195,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-ServiceApiLatency-threshold-Override_'), field('tags._amba-ServiceApiLatency-threshold-Override_'), parameters('threshold'))]" } ] }, @@ -307,7 +320,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-ServiceApiLatency-threshold-Override_'), field('tags._amba-ServiceApiLatency-threshold-Override_'), parameters('threshold'))]" } } } diff --git a/services/KeyVault/vaults/Deploy-KV-Requests-Alert.json b/services/KeyVault/vaults/Deploy-KV-Requests-Alert.json index 216a15e03..637cc481b 100644 --- a/services/KeyVault/vaults/Deploy-KV-Requests-Alert.json +++ b/services/KeyVault/vaults/Deploy-KV-Requests-Alert.json @@ -5,10 +5,10 @@ "properties": { "policyType": "Custom", "mode": "All", - "displayName": "Deploy KeyVault Requests Alert", + "displayName": "Deploy Key Vault Requests Alert", "description": "Policy to audit/deploy KeyVault Requests Alert", "metadata": { - "version": "1.2.0", + "version": "1.3.0", "category": "Key Vault", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -101,13 +101,26 @@ ], "defaultValue": "disabled" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Monitoring disabled", - "description": "Tag name to disable monitoring. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -118,8 +131,8 @@ "equals": "microsoft.keyvault/vaults" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, diff --git a/services/Network/applicationGateways/Deploy-AGW-ApplicationGatewayTotalTime-Alert.json b/services/Network/applicationGateways/Deploy-AGW-ApplicationGatewayTotalTime-Alert.json index 6c2b6cfd1..50ddaac51 100644 --- a/services/Network/applicationGateways/Deploy-AGW-ApplicationGatewayTotalTime-Alert.json +++ b/services/Network/applicationGateways/Deploy-AGW-ApplicationGatewayTotalTime-Alert.json @@ -9,7 +9,7 @@ "description": "Policy to audit/deploy Azure Application Gateway ApplicationGatewayTotalTime Alert", "metadata": { "version": "1.3.0", - "category": "Networking", + "Category": "Networking", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "_deployed_by_amba": "True" }, @@ -111,13 +111,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -135,8 +148,8 @@ ] }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, diff --git a/services/Network/applicationGateways/Deploy-AGW-BackendLastByteResponseTime-Alert.json b/services/Network/applicationGateways/Deploy-AGW-BackendLastByteResponseTime-Alert.json index 8db3423d1..fcf1172ca 100644 --- a/services/Network/applicationGateways/Deploy-AGW-BackendLastByteResponseTime-Alert.json +++ b/services/Network/applicationGateways/Deploy-AGW-BackendLastByteResponseTime-Alert.json @@ -9,7 +9,7 @@ "description": "Policy to audit/deploy Azure Application Gateway BackendLastByteResponseTime Alert", "metadata": { "version": "1.3.0", - "category": "Networking", + "Category": "Networking", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "_deployed_by_amba": "True" }, @@ -111,13 +111,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -135,8 +148,8 @@ ] }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, diff --git a/services/Network/applicationGateways/Deploy-AGW-CPUUtil-Alert.json b/services/Network/applicationGateways/Deploy-AGW-CPUUtil-Alert.json index 90902abff..ec90c50fd 100644 --- a/services/Network/applicationGateways/Deploy-AGW-CPUUtil-Alert.json +++ b/services/Network/applicationGateways/Deploy-AGW-CPUUtil-Alert.json @@ -8,8 +8,8 @@ "displayName": "Deploy AGW CPU Utilization Alert", "description": "Policy to audit/deploy Azure Application Gateway CPU Utilization Alert", "metadata": { - "version": "1.1.1", - "category": "Networking", + "version": "1.2.0", + "Category": "Networking", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "_deployed_by_amba": "True" }, @@ -106,13 +106,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -130,8 +143,8 @@ ] }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -186,7 +199,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-CpuUtilization-threshold-Override_'), field('tags._amba-CpuUtilization-threshold-Override_'), parameters('threshold'))]" } ] }, @@ -311,7 +324,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-CpuUtilization-threshold-Override_'), field('tags._amba-CpuUtilization-threshold-Override_'), parameters('threshold'))]" } } } diff --git a/services/Network/applicationGateways/Deploy-AGW-CapacityUnits-Alert.json b/services/Network/applicationGateways/Deploy-AGW-CapacityUnits-Alert.json index a3df992e7..88be67c46 100644 --- a/services/Network/applicationGateways/Deploy-AGW-CapacityUnits-Alert.json +++ b/services/Network/applicationGateways/Deploy-AGW-CapacityUnits-Alert.json @@ -8,8 +8,8 @@ "displayName": "Deploy AGW Capacity Units Alert", "description": "Policy to audit/deploy Azure Application Gateway CapacityUnits Alert", "metadata": { - "version": "1.1.1", - "category": "Networking", + "version": "1.2.0", + "Category": "Networking", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "_deployed_by_amba": "True" }, @@ -106,13 +106,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -130,8 +143,8 @@ ] }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -186,7 +199,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-CapacityUnits-threshold-Override_'), field('tags._amba-CapacityUnits-threshold-Override_'), parameters('threshold'))]" } ] }, @@ -311,7 +324,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-CapacityUnits-threshold-Override_'), field('tags._amba-CapacityUnits-threshold-Override_'), parameters('threshold'))]" } } } diff --git a/services/Network/applicationGateways/Deploy-AGW-ComputeUnits-Alert.json b/services/Network/applicationGateways/Deploy-AGW-ComputeUnits-Alert.json index 0c2d567c6..a03d4fb7d 100644 --- a/services/Network/applicationGateways/Deploy-AGW-ComputeUnits-Alert.json +++ b/services/Network/applicationGateways/Deploy-AGW-ComputeUnits-Alert.json @@ -8,8 +8,8 @@ "displayName": "Deploy AGW Compute Units Alert", "description": "Policy to audit/deploy Azure Application Gateway ComputeUnits Alert", "metadata": { - "version": "1.1.1", - "category": "Networking", + "version": "1.2.0", + "Category": "Networking", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "_deployed_by_amba": "True" }, @@ -106,13 +106,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -130,8 +143,8 @@ ] }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -154,7 +167,7 @@ }, { "field": "Microsoft.Insights/metricalerts/scopes[*]", - "equals": "[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/Microsoft.Network/applicationgateways/', field('fullName'))]" + "equals": "[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/applicationgateways/', field('fullName'))]" }, { "field": "Microsoft.Insights/metricAlerts/enabled", @@ -186,7 +199,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-ComputeUnits-threshold-Override_'), field('tags._amba-ComputeUnits-threshold-Override_'), parameters('threshold'))]" } ] }, @@ -311,7 +324,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-ComputeUnits-threshold-Override_'), field('tags._amba-ComputeUnits-threshold-Override_'), parameters('threshold'))]" } } } diff --git a/services/Network/applicationGateways/Deploy-AGW-FailedRequests-Alert.json b/services/Network/applicationGateways/Deploy-AGW-FailedRequests-Alert.json index 78fb33d69..0c68e680e 100644 --- a/services/Network/applicationGateways/Deploy-AGW-FailedRequests-Alert.json +++ b/services/Network/applicationGateways/Deploy-AGW-FailedRequests-Alert.json @@ -9,7 +9,7 @@ "description": "Policy to audit/deploy Azure Application Gateway FailedRequests Alert", "metadata": { "version": "1.2.0", - "category": "Networking", + "Category": "Networking", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "_deployed_by_amba": "True" }, @@ -111,13 +111,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -128,8 +141,8 @@ "equals": "Microsoft.Network/applicationgateways" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, diff --git a/services/Network/applicationGateways/Deploy-AGW-ResponseStatus-Alert.json b/services/Network/applicationGateways/Deploy-AGW-ResponseStatus-Alert.json index e4b0eba06..9b4c0f825 100644 --- a/services/Network/applicationGateways/Deploy-AGW-ResponseStatus-Alert.json +++ b/services/Network/applicationGateways/Deploy-AGW-ResponseStatus-Alert.json @@ -9,7 +9,7 @@ "description": "Policy to audit/deploy Azure Application Gateway ResponseStatus Alert", "metadata": { "version": "1.2.0", - "category": "Networking", + "Category": "Networking", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "_deployed_by_amba": "True" }, @@ -111,13 +111,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -128,8 +141,8 @@ "equals": "Microsoft.Network/applicationgateways" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, diff --git a/services/Network/applicationGateways/Deploy-AGW-UnhealthyHostCount-Alert.json b/services/Network/applicationGateways/Deploy-AGW-UnhealthyHostCount-Alert.json index 87da5be7d..623f57a0b 100644 --- a/services/Network/applicationGateways/Deploy-AGW-UnhealthyHostCount-Alert.json +++ b/services/Network/applicationGateways/Deploy-AGW-UnhealthyHostCount-Alert.json @@ -8,8 +8,8 @@ "displayName": "Deploy AGW Unhealthy Host Count Alert", "description": "Policy to audit/deploy Azure Application Gateway Unhealthy Host Count Alert", "metadata": { - "version": "1.1.1", - "category": "Networking", + "version": "1.2.0", + "Category": "Networking", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "_deployed_by_amba": "True" }, @@ -106,13 +106,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -123,8 +136,8 @@ "equals": "Microsoft.Network/applicationgateways" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -147,7 +160,7 @@ }, { "field": "Microsoft.Insights/metricalerts/scopes[*]", - "equals": "[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/loadBalancers/', field('fullName'))]" + "equals": "[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/applicationgateways/', field('fullName'))]" }, { "field": "Microsoft.Insights/metricAlerts/enabled", @@ -179,7 +192,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-UnhealthyHostCount-threshold-Override_'), field('tags._amba-UnhealthyHostCount-threshold-Override_'), parameters('threshold'))]" } ] }, @@ -304,7 +317,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-UnhealthyHostCount-threshold-Override_'), field('tags._amba-UnhealthyHostCount-threshold-Override_'), parameters('threshold'))]" } } } diff --git a/services/Network/azureFirewalls/Deploy-AFW-FirewallHealth-Alert.json b/services/Network/azureFirewalls/Deploy-AFW-FirewallHealth-Alert.json index 335f92f66..898b8d95f 100644 --- a/services/Network/azureFirewalls/Deploy-AFW-FirewallHealth-Alert.json +++ b/services/Network/azureFirewalls/Deploy-AFW-FirewallHealth-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy AFW FirewallHealth Alert", "description": "Policy to audit/deploy Azure Firewall FirewallHealth Alert", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Network", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -109,13 +109,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -126,8 +139,8 @@ "equals": "Microsoft.Network/azureFirewalls" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -182,7 +195,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-FirewallHealth-threshold-Override_'), field('tags._amba-FirewallHealth-threshold-Override_'), parameters('threshold'))]" } ] }, @@ -307,7 +320,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-FirewallHealth-threshold-Override_'), field('tags._amba-FirewallHealth-threshold-Override_'), parameters('threshold'))]" } } } diff --git a/services/Network/azureFirewalls/Deploy-AFW-SNATPortUtilization-Alert.json b/services/Network/azureFirewalls/Deploy-AFW-SNATPortUtilization-Alert.json index cfedc6b91..59b353e51 100644 --- a/services/Network/azureFirewalls/Deploy-AFW-SNATPortUtilization-Alert.json +++ b/services/Network/azureFirewalls/Deploy-AFW-SNATPortUtilization-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy AFW SNATPortUtilization Alert", "description": "Policy to audit/deploy Azure Firewall SNATPortUtilization Alert", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Network", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -109,13 +109,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -126,8 +139,8 @@ "equals": "Microsoft.Network/azureFirewalls" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -182,7 +195,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-SNATPortUtilization-threshold-Override_'), field('tags._amba-SNATPortUtilization-threshold-Override_'), parameters('threshold'))]" } ] }, @@ -307,7 +320,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-SNATPortUtilization-threshold-Override_'), field('tags._amba-SNATPortUtilization-threshold-Override_'), parameters('threshold'))]" } } } diff --git a/services/Network/azureFirewalls/Deploy-ActivityLog-AzureFirewall-Del.json b/services/Network/azureFirewalls/Deploy-ActivityLog-AzureFirewall-Del.json index 939120580..9e22884ad 100644 --- a/services/Network/azureFirewalls/Deploy-ActivityLog-AzureFirewall-Del.json +++ b/services/Network/azureFirewalls/Deploy-ActivityLog-AzureFirewall-Del.json @@ -8,7 +8,7 @@ "displayName": "Deploy Activity Log Azure FireWall Delete Alert", "description": "Policy to Deploy Activity Log Azure Firewall Delete Alert", "metadata": { - "version": "1.0.2", + "version": "1.1.0", "category": "Network", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -44,8 +44,7 @@ "description": "Tags on the Resource group the alert is placed in" }, "defaultValue": { - "environment": "test", - "_deployed_by_amba": true + "Project": "amba-monitoring" } }, "alertResourceGroupLocation": { @@ -56,13 +55,38 @@ }, "defaultValue": "centralus" }, - "MonitorDisable": { + "effect": { "type": "String", "metadata": { "displayName": "Effect", - "description": "Tag name to disable monitoring on resource. Set to true if monitoring should be disabled" + "description": "Effect of the policy" + }, + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "defaultValue": "deployIfNotExists" + }, + "MonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name to disable monitoring. Set to true if monitoring should be disabled" }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -73,13 +97,13 @@ "equals": "Microsoft.Network/azureFirewalls" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, "then": { - "effect": "deployIfNotExists", + "effect": "[[parameters('effect')]", "details": { "roleDefinitionIds": [ "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c" diff --git a/services/Network/expressRouteCircuits/Deploy-ERCIR-ARPAvailability-Alert.json b/services/Network/expressRouteCircuits/Deploy-ERCIR-ARPAvailability-Alert.json index 1c91070a4..6c8daf756 100644 --- a/services/Network/expressRouteCircuits/Deploy-ERCIR-ARPAvailability-Alert.json +++ b/services/Network/expressRouteCircuits/Deploy-ERCIR-ARPAvailability-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy ExpressRoute Circuits Arp Availability Alert", "description": "Policy to audit/deploy ExpressRoute Circuits Arp Availability Alert", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Network", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -109,13 +109,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -126,8 +139,8 @@ "equals": "Microsoft.Network/expressRouteCircuits" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -182,7 +195,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-ArpAvailability-threshold-Override_'), field('tags._amba-ArpAvailability-threshold-Override_'), parameters('threshold'))]" } ] }, @@ -307,7 +320,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-ArpAvailability-threshold-Override_'), field('tags._amba-ArpAvailability-threshold-Override_'), parameters('threshold'))]" } } } diff --git a/services/Network/expressRouteCircuits/Deploy-ERCIR-BGPAvailability-Alert.json b/services/Network/expressRouteCircuits/Deploy-ERCIR-BGPAvailability-Alert.json index 5af9833d7..3813060fa 100644 --- a/services/Network/expressRouteCircuits/Deploy-ERCIR-BGPAvailability-Alert.json +++ b/services/Network/expressRouteCircuits/Deploy-ERCIR-BGPAvailability-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy ExpressRoute Circuits Bgp Availability Alert", "description": "Policy to audit/deploy ExpressRoute Circuits Bgp Availability Alert", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Network", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -109,13 +109,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -126,8 +139,8 @@ "equals": "Microsoft.Network/expressRouteCircuits" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -182,7 +195,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-BgpAvailability-threshold-Override_'), field('tags._amba-BgpAvailability-threshold-Override_'), parameters('threshold'))]" } ] }, @@ -307,7 +320,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-BgpAvailability-threshold-Override_'), field('tags._amba-BgpAvailability-threshold-Override_'), parameters('threshold'))]" } } } diff --git a/services/Network/expressRouteCircuits/Deploy-ERCIR-QOSDropsBitsIn-Alert.json b/services/Network/expressRouteCircuits/Deploy-ERCIR-QOSDropsBitsIn-Alert.json index 7236416d6..26d4c2f1a 100644 --- a/services/Network/expressRouteCircuits/Deploy-ERCIR-QOSDropsBitsIn-Alert.json +++ b/services/Network/expressRouteCircuits/Deploy-ERCIR-QOSDropsBitsIn-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy ExpressRoute Circuits QosDropBitsInPerSecond Alert", "description": "Policy to audit/deploy ExpressRoute Circuits QosDropBitsInPerSecond Alert", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Network", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -101,13 +101,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -118,8 +131,8 @@ "equals": "Microsoft.Network/expressRouteCircuits" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, diff --git a/services/Network/expressRouteCircuits/Deploy-ERCIR-QOSDropsBitsOut-Alert.json b/services/Network/expressRouteCircuits/Deploy-ERCIR-QOSDropsBitsOut-Alert.json index 4ab54e895..19e8d0b34 100644 --- a/services/Network/expressRouteCircuits/Deploy-ERCIR-QOSDropsBitsOut-Alert.json +++ b/services/Network/expressRouteCircuits/Deploy-ERCIR-QOSDropsBitsOut-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy ExpressRoute Circuits QosDropBitsOutPerSecond Alert", "description": "Policy to audit/deploy ExpressRoute Circuits QosDropBitsOutPerSecond Alert", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Network", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -101,13 +101,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -118,8 +131,8 @@ "equals": "Microsoft.Network/expressRouteCircuits" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, diff --git a/services/Network/expressRouteGateways/Deploy-ERG-BitsInPerSecond-Alert.json b/services/Network/expressRouteGateways/Deploy-ERG-BitsInPerSecond-Alert.json index b42e1471d..fae230d72 100644 --- a/services/Network/expressRouteGateways/Deploy-ERG-BitsInPerSecond-Alert.json +++ b/services/Network/expressRouteGateways/Deploy-ERG-BitsInPerSecond-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy ERG ExpressRoute Bits In Alert", "description": "Policy to audit/deploy ER Gateway Connection BitsInPerSecond Alert", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Network", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -109,13 +109,26 @@ ], "defaultValue": "disabled" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -126,8 +139,8 @@ "equals": "Microsoft.Network/expressroutegateways" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -182,7 +195,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-ERGatewayConnectionBitsInPerSecond-threshold-Override_'), field('tags._amba-ERGatewayConnectionBitsInPerSecond-threshold-Override_'), parameters('threshold'))]" } ] }, @@ -307,7 +320,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-ERGatewayConnectionBitsInPerSecond-threshold-Override_'), field('tags._amba-ERGatewayConnectionBitsInPerSecond-threshold-Override_'), parameters('threshold'))]" } } } diff --git a/services/Network/expressRouteGateways/Deploy-ERG-BitsOutPerSecond-Alert.json b/services/Network/expressRouteGateways/Deploy-ERG-BitsOutPerSecond-Alert.json index 57467b2a6..18cae9625 100644 --- a/services/Network/expressRouteGateways/Deploy-ERG-BitsOutPerSecond-Alert.json +++ b/services/Network/expressRouteGateways/Deploy-ERG-BitsOutPerSecond-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy ERG ExpressRoute Bits Out Alert", "description": "Policy to audit/deploy ER Gateway Connection BitsOutPerSecond Alert", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Network", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -109,13 +109,26 @@ ], "defaultValue": "disabled" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -126,8 +139,8 @@ "equals": "Microsoft.Network/expressroutegateways" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -182,7 +195,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-ERGatewayConnectionBitsOutPerSecond-threshold-Override_'), field('tags._amba-ERGatewayConnectionBitsOutPerSecond-threshold-Override_'), parameters('threshold'))]" } ] }, @@ -307,7 +320,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-ERGatewayConnectionBitsOutPerSecond-threshold-Override_'), field('tags._amba-ERGatewayConnectionBitsOutPerSecond-threshold-Override_'), parameters('threshold'))]" } } } diff --git a/services/Network/expressRouteGateways/Deploy-ERG-CPUUtilization-Alert.json b/services/Network/expressRouteGateways/Deploy-ERG-CPUUtilization-Alert.json index 37d2eb679..43dd37696 100644 --- a/services/Network/expressRouteGateways/Deploy-ERG-CPUUtilization-Alert.json +++ b/services/Network/expressRouteGateways/Deploy-ERG-CPUUtilization-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy ERG ExpressRoute CPU Utilization Alert", "description": "Policy to audit/deploy ER Gateway Express Route CPU Utilization Alert", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Network", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -109,13 +109,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -126,8 +139,8 @@ "equals": "Microsoft.Network/expressroutegateways" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -182,7 +195,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-ExpressRouteGatewayCpuUtilization-threshold-Override_'), field('tags._amba-ExpressRouteGatewayCpuUtilization-threshold-Override_'), parameters('threshold'))]" } ] }, @@ -307,7 +320,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-ExpressRouteGatewayCpuUtilization-threshold-Override_'), field('tags._amba-ExpressRouteGatewayCpuUtilization-threshold-Override_'), parameters('threshold'))]" } } } diff --git a/services/Network/expressRoutePorts/Deploy-ERP-BitsInPerSecond-Alert.json b/services/Network/expressRoutePorts/Deploy-ERP-BitsInPerSecond-Alert.json index c18aad721..10483f1a1 100644 --- a/services/Network/expressRoutePorts/Deploy-ERP-BitsInPerSecond-Alert.json +++ b/services/Network/expressRoutePorts/Deploy-ERP-BitsInPerSecond-Alert.json @@ -8,8 +8,8 @@ "displayName": "Deploy ER Direct ExpressRoute Bits In Alert", "description": "Policy to audit/deploy ER Direct Connection BitsInPerSecond Alert", "metadata": { - "version": "1.1.1", - "category": "Networking", + "version": "1.2.0", + "Category": "Networking", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "_deployed_by_amba": "True" }, @@ -106,13 +106,26 @@ ], "defaultValue": "disabled" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -123,8 +136,8 @@ "equals": "Microsoft.Network/expressRoutePorts" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -179,7 +192,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-PortBitsInPerSecond-threshold-Override_'), field('tags._amba-PortBitsInPerSecond-threshold-Override_'), parameters('threshold'))]" } ] }, @@ -304,7 +317,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-PortBitsInPerSecond-threshold-Override_'), field('tags._amba-PortBitsInPerSecond-threshold-Override_'), parameters('threshold'))]" } } } diff --git a/services/Network/expressRoutePorts/Deploy-ERP-BitsOutPerSecond-Alert.json b/services/Network/expressRoutePorts/Deploy-ERP-BitsOutPerSecond-Alert.json index 168960f35..a4290c982 100644 --- a/services/Network/expressRoutePorts/Deploy-ERP-BitsOutPerSecond-Alert.json +++ b/services/Network/expressRoutePorts/Deploy-ERP-BitsOutPerSecond-Alert.json @@ -8,8 +8,8 @@ "displayName": "Deploy ER Direct ExpressRoute Bits Out Alert", "description": "Policy to audit/deploy ER Direct Connection BitsOutPerSecond Alert", "metadata": { - "version": "1.1.1", - "category": "Networking", + "version": "1.2.0", + "Category": "Networking", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "_deployed_by_amba": "True" }, @@ -106,13 +106,26 @@ ], "defaultValue": "disabled" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -123,8 +136,8 @@ "equals": "Microsoft.Network/expressRoutePorts" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -179,7 +192,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-PortBitsOutPerSecond-threshold-Override_'), field('tags._amba-PortBitsOutPerSecond-threshold-Override_'), parameters('threshold'))]" } ] }, @@ -304,7 +317,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-PortBitsOutPerSecond-threshold-Override_'), field('tags._amba-PortBitsOutPerSecond-threshold-Override_'), parameters('threshold'))]" } } } diff --git a/services/Network/expressRoutePorts/Deploy-ERP-LineProtocol-Alert.json b/services/Network/expressRoutePorts/Deploy-ERP-LineProtocol-Alert.json index 18e21bccd..93668535e 100644 --- a/services/Network/expressRoutePorts/Deploy-ERP-LineProtocol-Alert.json +++ b/services/Network/expressRoutePorts/Deploy-ERP-LineProtocol-Alert.json @@ -8,8 +8,8 @@ "displayName": "Deploy ER Direct ExpressRoute LineProtocol Alert", "description": "Policy to audit/deploy ER Direct LineProtocol Alert", "metadata": { - "version": "1.1.1", - "category": "Networking", + "version": "1.2.0", + "Category": "Networking", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "_deployed_by_amba": "True" }, @@ -106,13 +106,26 @@ ], "defaultValue": "disabled" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -123,8 +136,8 @@ "equals": "Microsoft.Network/expressRoutePorts" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -179,7 +192,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-LineProtocol-threshold-Override_'), field('tags._amba-LineProtocol-threshold-Override_'), parameters('threshold'))]" } ] }, @@ -304,7 +317,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-LineProtocol-threshold-Override_'), field('tags._amba-LineProtocol-threshold-Override_'), parameters('threshold'))]" } } } diff --git a/services/Network/expressRoutePorts/Deploy-ERP-RxLightLevelHigh-Alert.json b/services/Network/expressRoutePorts/Deploy-ERP-RxLightLevelHigh-Alert.json index b7795c8fc..2419f1bd1 100644 --- a/services/Network/expressRoutePorts/Deploy-ERP-RxLightLevelHigh-Alert.json +++ b/services/Network/expressRoutePorts/Deploy-ERP-RxLightLevelHigh-Alert.json @@ -106,13 +106,26 @@ ], "defaultValue": "disabled" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -123,8 +136,8 @@ "equals": "Microsoft.Network/expressRoutePorts" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -183,7 +196,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-RxLightLevel-High-threshold-Override_'), field('tags._amba-RxLightLevel-High-threshold-Override_'), parameters('threshold'))]" } ] }, @@ -308,7 +321,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-RxLightLevel-High-threshold-Override_'), field('tags._amba-RxLightLevel-High-threshold-Override_'), parameters('threshold'))]" } } } diff --git a/services/Network/expressRoutePorts/Deploy-ERP-RxLightLevelLow-Alert.json b/services/Network/expressRoutePorts/Deploy-ERP-RxLightLevelLow-Alert.json index 4e7db7ee3..e5f9520d1 100644 --- a/services/Network/expressRoutePorts/Deploy-ERP-RxLightLevelLow-Alert.json +++ b/services/Network/expressRoutePorts/Deploy-ERP-RxLightLevelLow-Alert.json @@ -8,8 +8,8 @@ "displayName": "Deploy ER Direct ExpressRoute RxLightLevel Low Alert", "description": "Policy to audit/deploy ER Direct RxLightLevel Low Alert", "metadata": { - "version": "1.1.1", - "category": "Networking", + "version": "1.2.0", + "Category": "Networking", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "_deployed_by_amba": "True" }, @@ -106,13 +106,26 @@ ], "defaultValue": "disabled" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -123,8 +136,8 @@ "equals": "Microsoft.Network/expressRoutePorts" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -183,7 +196,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-RxLightLevel-Low-threshold-Override_'), field('tags._amba-RxLightLevel-Low-threshold-Override_'), parameters('threshold'))]" } ] }, @@ -308,7 +321,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-RxLightLevel-Low-threshold-Override_'), field('tags._amba-RxLightLevel-Low-threshold-Override_'), parameters('threshold'))]" } } } diff --git a/services/Network/expressRoutePorts/Deploy-ERP-TxLightLevelHigh-Alert.json b/services/Network/expressRoutePorts/Deploy-ERP-TxLightLevelHigh-Alert.json index 6b2392cb8..d5d85e726 100644 --- a/services/Network/expressRoutePorts/Deploy-ERP-TxLightLevelHigh-Alert.json +++ b/services/Network/expressRoutePorts/Deploy-ERP-TxLightLevelHigh-Alert.json @@ -8,8 +8,8 @@ "displayName": "Deploy ER Direct ExpressRoute TxLightLevel High Alert", "description": "Policy to audit/deploy ER Direct TxLightLevel High Alert", "metadata": { - "version": "1.1.1", - "category": "Networking", + "version": "1.2.0", + "Category": "Networking", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "_deployed_by_amba": "True" }, @@ -106,13 +106,26 @@ ], "defaultValue": "disabled" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -123,8 +136,8 @@ "equals": "Microsoft.Network/expressRoutePorts" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -183,7 +196,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-TxLightLevel-High-threshold-Override_'), field('tags._amba-TxLightLevel-High-threshold-Override_'), parameters('threshold'))]" } ] }, @@ -308,7 +321,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-TxLightLevel-High-threshold-Override_'), field('tags._amba-TxLightLevel-High-threshold-Override_'), parameters('threshold'))]" } } } diff --git a/services/Network/expressRoutePorts/Deploy-ERP-TxLightLevelLow-Alert.json b/services/Network/expressRoutePorts/Deploy-ERP-TxLightLevelLow-Alert.json index 0fb7b6e9f..d2ea2b19f 100644 --- a/services/Network/expressRoutePorts/Deploy-ERP-TxLightLevelLow-Alert.json +++ b/services/Network/expressRoutePorts/Deploy-ERP-TxLightLevelLow-Alert.json @@ -8,8 +8,8 @@ "displayName": "Deploy ER Direct ExpressRoute TxLightLevel Low Alert", "description": "Policy to audit/deploy ER Direct TxLightLevel Low Alert", "metadata": { - "version": "1.1.1", - "category": "Networking", + "version": "1.2.0", + "Category": "Networking", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "_deployed_by_amba": "True" }, @@ -106,13 +106,26 @@ ], "defaultValue": "disabled" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -123,8 +136,8 @@ "equals": "Microsoft.Network/expressRoutePorts" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -183,7 +196,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-TxLightLevel-Low-threshold-Override_'), field('tags._amba-TxLightLevel-Low-threshold-Override_'), parameters('threshold'))]" } ] }, @@ -308,7 +321,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-TxLightLevel-Low-threshold-Override_'), field('tags._amba-TxLightLevel-Low-threshold-Override_'), parameters('threshold'))]" } } } diff --git a/services/Network/frontDoors/Deploy-FD-BackendHealth-Alert.json b/services/Network/frontDoors/Deploy-FD-BackendHealth-Alert.json index 47e5fb8e8..710f0eb7b 100644 --- a/services/Network/frontDoors/Deploy-FD-BackendHealth-Alert.json +++ b/services/Network/frontDoors/Deploy-FD-BackendHealth-Alert.json @@ -106,13 +106,26 @@ ], "defaultValue": "disabled" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name to disable monitoring. Set to true if monitoring should be disabled" }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -123,8 +136,8 @@ "equals": "Microsoft.Network/frontdoors" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -179,7 +192,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-BackendHealthPercentage-threshold-Override_'), field('tags._amba-BackendHealthPercentage-threshold-Override_'), parameters('threshold'))]" } ] }, @@ -304,7 +317,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-BackendHealthPercentage-threshold-Override_'), field('tags._amba-BackendHealthPercentage-threshold-Override_'), parameters('threshold'))]" } } } diff --git a/services/Network/frontDoors/Deploy-FD-BackendRequestLatency-Alert.json b/services/Network/frontDoors/Deploy-FD-BackendRequestLatency-Alert.json index a88f349f7..5eefcdd29 100644 --- a/services/Network/frontDoors/Deploy-FD-BackendRequestLatency-Alert.json +++ b/services/Network/frontDoors/Deploy-FD-BackendRequestLatency-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy Frontdoor Backend Request Latency Alert", "description": "Policy to audit/deploy Frontdoor Backend Request Latency Alert", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Networking", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -101,13 +101,26 @@ ], "defaultValue": "disabled" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -118,8 +131,8 @@ "equals": "Microsoft.Network/frontdoors" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, diff --git a/services/Network/loadBalancers/Deploy-LB-DatapathAvailability-Alert.json b/services/Network/loadBalancers/Deploy-LB-DatapathAvailability-Alert.json index 801e51e2d..69625154e 100644 --- a/services/Network/loadBalancers/Deploy-LB-DatapathAvailability-Alert.json +++ b/services/Network/loadBalancers/Deploy-LB-DatapathAvailability-Alert.json @@ -8,8 +8,8 @@ "displayName": "Deploy ALB Data Path Availability Alert", "description": "Policy to audit/deploy Azure Load Balancer Data Path Availability Alert", "metadata": { - "version": "1.1.1", - "category": "Networking", + "version": "1.2.0", + "Category": "Networking", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "_deployed_by_amba": "True" }, @@ -106,13 +106,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -130,8 +143,8 @@ ] }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -186,7 +199,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-VipAvailability-threshold-Override_'), field('tags._amba-VipAvailability-threshold-Override_'), parameters('threshold'))]" } ] }, @@ -311,7 +324,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-VipAvailability-threshold-Override_'), field('tags._amba-VipAvailability-threshold-Override_'), parameters('threshold'))]" } } } diff --git a/services/Network/loadBalancers/Deploy-LB-GlobalBackendAvailability-Alert.json b/services/Network/loadBalancers/Deploy-LB-GlobalBackendAvailability-Alert.json index aed427b8c..94d57055a 100644 --- a/services/Network/loadBalancers/Deploy-LB-GlobalBackendAvailability-Alert.json +++ b/services/Network/loadBalancers/Deploy-LB-GlobalBackendAvailability-Alert.json @@ -8,8 +8,8 @@ "displayName": "Deploy ALB Global Backend Availability Alert", "description": "Policy to audit/deploy Azure Load Balancer Global Backend Availability Alert", "metadata": { - "version": "1.1.1", - "category": "Networking", + "version": "1.2.0", + "Category": "Networking", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "_deployed_by_amba": "True" }, @@ -106,13 +106,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -127,8 +140,8 @@ "equals": "Global" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -183,7 +196,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-GlobalBackendAvailability-threshold-Override_'), field('tags._amba-GlobalBackendAvailability-threshold-Override_'), parameters('threshold'))]" } ] }, @@ -308,7 +321,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-GlobalBackendAvailability-threshold-Override_'), field('tags._amba-GlobalBackendAvailability-threshold-Override_'), parameters('threshold'))]" } } } diff --git a/services/Network/loadBalancers/Deploy-LB-HealthProbeStatus-Alert.json b/services/Network/loadBalancers/Deploy-LB-HealthProbeStatus-Alert.json index 6987337ca..7b3f67c37 100644 --- a/services/Network/loadBalancers/Deploy-LB-HealthProbeStatus-Alert.json +++ b/services/Network/loadBalancers/Deploy-LB-HealthProbeStatus-Alert.json @@ -8,8 +8,8 @@ "displayName": "Deploy ALB Health Probe Status Alert", "description": "Policy to audit/deploy Azure Load Balancer Health Probe Status Alert", "metadata": { - "version": "1.1.1", - "category": "Networking", + "version": "1.2.0", + "Category": "Networking", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "_deployed_by_amba": "True" }, @@ -106,13 +106,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -134,8 +147,8 @@ "equals": "Regional" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -190,7 +203,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-DipAvailability-threshold-Override_'), field('tags._amba-DipAvailability-threshold-Override_'), parameters('threshold'))]" } ] }, @@ -315,7 +328,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-DipAvailability-threshold-Override_'), field('tags._amba-DipAvailability-threshold-Override_'), parameters('threshold'))]" } } } diff --git a/services/Network/loadBalancers/Deploy-LB-UsedSNATPorts-Alert.json b/services/Network/loadBalancers/Deploy-LB-UsedSNATPorts-Alert.json index 6515ef113..afec29cd1 100644 --- a/services/Network/loadBalancers/Deploy-LB-UsedSNATPorts-Alert.json +++ b/services/Network/loadBalancers/Deploy-LB-UsedSNATPorts-Alert.json @@ -8,8 +8,8 @@ "displayName": "Deploy ALB Used SNAT Ports Alert", "description": "Policy to audit/deploy Azure Load Balancer Used SNAT Ports Alert", "metadata": { - "version": "1.1.1", - "category": "Networking", + "version": "1.2.0", + "Category": "Networking", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "_deployed_by_amba": "True" }, @@ -106,13 +106,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -123,8 +136,8 @@ "equals": "Microsoft.Network/loadBalancers" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -179,7 +192,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-UsedSNATPorts-threshold-Override_'), field('tags._amba-UsedSNATPorts-threshold-Override_'), parameters('threshold'))]" } ] }, @@ -304,7 +317,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-UsedSNATPorts-threshold-Override_'), field('tags._amba-UsedSNATPorts-threshold-Override_'), parameters('threshold'))]" } } } diff --git a/services/Network/networkSecurityGroups/Deploy-ActivityLog-NSG-Del.json b/services/Network/networkSecurityGroups/Deploy-ActivityLog-NSG-Del.json index fc1e0f939..8d7ab78f0 100644 --- a/services/Network/networkSecurityGroups/Deploy-ActivityLog-NSG-Del.json +++ b/services/Network/networkSecurityGroups/Deploy-ActivityLog-NSG-Del.json @@ -8,7 +8,7 @@ "displayName": "Deploy Activity Log NSG Delete Alert", "description": "Policy to Deploy Activity Log NSG Delete Alert", "metadata": { - "version": "1.0.2", + "version": "1.1.0", "category": "Network", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -44,8 +44,7 @@ "description": "Tags on the Resource group the alert is placed in" }, "defaultValue": { - "environment": "test", - "_deployed_by_amba": true + "Project": "amba-monitoring" } }, "alertResourceGroupLocation": { @@ -56,13 +55,38 @@ }, "defaultValue": "centralus" }, - "MonitorDisable": { + "effect": { "type": "String", "metadata": { "displayName": "Effect", - "description": "Tag name to disable monitoring on resource. Set to true if monitoring should be disabled" + "description": "Effect of the policy" + }, + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "defaultValue": "deployIfNotExists" + }, + "MonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name to disable monitoring. Set to true if monitoring should be disabled" }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -73,13 +97,13 @@ "equals": "Microsoft.Network/networkSecurityGroups" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, "then": { - "effect": "deployIfNotExists", + "effect": "[[parameters('effect')]", "details": { "roleDefinitionIds": [ "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c" diff --git a/services/Network/privateDnsZones/Deploy-PDNSZ-CapacityUtilization-Alert.json b/services/Network/privateDnsZones/Deploy-PDNSZ-CapacityUtilization-Alert.json index ee6c91666..ac24d1082 100644 --- a/services/Network/privateDnsZones/Deploy-PDNSZ-CapacityUtilization-Alert.json +++ b/services/Network/privateDnsZones/Deploy-PDNSZ-CapacityUtilization-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy PDNSZ Capacity Utilization Alert", "description": "Policy to audit/deploy Private DNS Zone Capacity Utilization Alert", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Network", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -109,13 +109,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -126,8 +139,8 @@ "equals": "Microsoft.Network/privateDnsZones" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -182,7 +195,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-VirtualNetworkLinkCapacityUtilization-threshold-Override_'), field('tags._amba-VirtualNetworkLinkCapacityUtilization-threshold-Override_'), parameters('threshold'))]" } ] }, @@ -307,7 +320,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-VirtualNetworkLinkCapacityUtilization-threshold-Override_'), field('tags._amba-VirtualNetworkLinkCapacityUtilization-threshold-Override_'), parameters('threshold'))]" } } } diff --git a/services/Network/privateDnsZones/Deploy-PDNSZ-QueryVolume-Alert.json b/services/Network/privateDnsZones/Deploy-PDNSZ-QueryVolume-Alert.json index e1c74ce8f..de76d0c18 100644 --- a/services/Network/privateDnsZones/Deploy-PDNSZ-QueryVolume-Alert.json +++ b/services/Network/privateDnsZones/Deploy-PDNSZ-QueryVolume-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy PDNSZ Query Volume Alert", "description": "Policy to audit/deploy Private DNS Zone Query Volume Alert", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Network", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -109,13 +109,26 @@ ], "defaultValue": "disabled" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -126,8 +139,8 @@ "equals": "Microsoft.Network/privateDnsZones" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -182,7 +195,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-QueryVolume-threshold-Override_'), field('tags._amba-QueryVolume-threshold-Override_'), parameters('threshold'))]" } ] }, @@ -231,7 +244,7 @@ { "type": "Microsoft.Insights/metricAlerts", "apiVersion": "2018-03-01", - "name": "[[concat(parameters('resourceName'), '-QueryVolumeAlert')]", + "name": "[[concat(parameters('resourceName'), '-QueryVolumeAlert')]", "location": "global", "tags": { "_deployed_by_amba": true @@ -307,7 +320,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-QueryVolume-threshold-Override_'), field('tags._amba-QueryVolume-threshold-Override_'), parameters('threshold'))]" } } } diff --git a/services/Network/privateDnsZones/Deploy-PDNSZ-RecordSetCapacity-Alert.json b/services/Network/privateDnsZones/Deploy-PDNSZ-RecordSetCapacity-Alert.json index 1082e2f07..c009305a7 100644 --- a/services/Network/privateDnsZones/Deploy-PDNSZ-RecordSetCapacity-Alert.json +++ b/services/Network/privateDnsZones/Deploy-PDNSZ-RecordSetCapacity-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy PDNSZ Record Set Capacity Alert", "description": "Policy to audit/deploy Private DNS Zone Record Set Capacity Alert", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Network", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -109,13 +109,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -126,8 +139,8 @@ "equals": "Microsoft.Network/privateDnsZones" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -182,7 +195,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-RecordSetCapacityUtilization-threshold-Override_'), field('tags._amba-RecordSetCapacityUtilization-threshold-Override_'), parameters('threshold'))]" } ] }, @@ -307,7 +320,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-RecordSetCapacityUtilization-threshold-Override_'), field('tags._amba-RecordSetCapacityUtilization-threshold-Override_'), parameters('threshold'))]" } } } diff --git a/services/Network/privateDnsZones/Deploy-PDNSZ-RegistrationCapacityUtilization-Alert.json b/services/Network/privateDnsZones/Deploy-PDNSZ-RegistrationCapacityUtilization-Alert.json index aa7c884d7..7cecb2087 100644 --- a/services/Network/privateDnsZones/Deploy-PDNSZ-RegistrationCapacityUtilization-Alert.json +++ b/services/Network/privateDnsZones/Deploy-PDNSZ-RegistrationCapacityUtilization-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy PDNSZ Registration Capacity Utilization Alert", "description": "Policy to audit/deploy Private DNS Zone Registration Capacity Utilization Alert", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Network", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -109,13 +109,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -126,8 +139,8 @@ "equals": "Microsoft.Network/privateDnsZones" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -182,7 +195,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-VirtualNetworkWithRegistrationCapacityUtilization-threshold-Override_'), field('tags._amba-VirtualNetworkWithRegistrationCapacityUtilization-threshold-Override_'), parameters('threshold'))]" } ] }, @@ -307,7 +320,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-VirtualNetworkWithRegistrationCapacityUtilization-threshold-Override_'), field('tags._amba-VirtualNetworkWithRegistrationCapacityUtilization-threshold-Override_'), parameters('threshold'))]" } } } diff --git a/services/Network/publicIPAddresses/Deploy-PIP-BytesInDDOSAttack-Alert.json b/services/Network/publicIPAddresses/Deploy-PIP-BytesInDDOSAttack-Alert.json index 763ec7be5..e042c882f 100644 --- a/services/Network/publicIPAddresses/Deploy-PIP-BytesInDDOSAttack-Alert.json +++ b/services/Network/publicIPAddresses/Deploy-PIP-BytesInDDOSAttack-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy PIP Bytes in DDoS Attack Alert", "description": "Policy to audit/deploy PIP Bytes in DDoS Attack Alert", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Network", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -109,13 +109,26 @@ ], "defaultValue": "disabled" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -126,8 +139,8 @@ "equals": "Microsoft.Network/publicIPAddresses" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -182,7 +195,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-bytesinddos-threshold-Override_'), field('tags._amba-bytesinddos-threshold-Override_'), parameters('threshold'))]" } ] }, @@ -307,7 +320,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-bytesinddos-threshold-Override_'), field('tags._amba-bytesinddos-threshold-Override_'), parameters('threshold'))]" } } } diff --git a/services/Network/publicIPAddresses/Deploy-PIP-DDOSAttack-Alert.json b/services/Network/publicIPAddresses/Deploy-PIP-DDOSAttack-Alert.json index cda28bcfd..bc9afcc01 100644 --- a/services/Network/publicIPAddresses/Deploy-PIP-DDOSAttack-Alert.json +++ b/services/Network/publicIPAddresses/Deploy-PIP-DDOSAttack-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy PIP DDoS Attack Alert", "description": "Policy to audit/deploy PIP DDoS Attack Alert", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Network", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -109,13 +109,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -126,8 +139,8 @@ "equals": "Microsoft.Network/publicIPAddresses" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -182,7 +195,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-ifunderddosattack-threshold-Override_'), field('tags._amba-ifunderddosattack-threshold-Override_'), parameters('threshold'))]" } ] }, @@ -307,7 +320,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-ifunderddosattack-threshold-Override_'), field('tags._amba-ifunderddosattack-threshold-Override_'), parameters('threshold'))]" } } } diff --git a/services/Network/publicIPAddresses/Deploy-PIP-PacketsInDDOS-Alert.json b/services/Network/publicIPAddresses/Deploy-PIP-PacketsInDDOS-Alert.json index fe9563e0d..e24c1eaaf 100644 --- a/services/Network/publicIPAddresses/Deploy-PIP-PacketsInDDOS-Alert.json +++ b/services/Network/publicIPAddresses/Deploy-PIP-PacketsInDDOS-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy PIP Packets in DDoS Attack Alert", "description": "Policy to audit/deploy PIP Packets in DDoS Attack Alert", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Network", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -109,13 +109,26 @@ ], "defaultValue": "disabled" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -126,8 +139,8 @@ "equals": "Microsoft.Network/publicIPAddresses" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -182,7 +195,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-PacketsInDDoS-threshold-Override_'), field('tags._amba-PacketsInDDoS-threshold-Override_'), parameters('threshold'))]" } ] }, @@ -307,7 +320,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-PacketsInDDoS-threshold-Override_'), field('tags._amba-PacketsInDDoS-threshold-Override_'), parameters('threshold'))]" } } } diff --git a/services/Network/publicIPAddresses/Deploy-PIP-VIPAvailability-Alert.json b/services/Network/publicIPAddresses/Deploy-PIP-VIPAvailability-Alert.json index 006e75b61..c7d7f7075 100644 --- a/services/Network/publicIPAddresses/Deploy-PIP-VIPAvailability-Alert.json +++ b/services/Network/publicIPAddresses/Deploy-PIP-VIPAvailability-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy PIP VIP Availability Alert", "description": "Policy to audit/deploy PIP VIP Availability Alert", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Network", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -109,13 +109,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -130,8 +143,8 @@ "equals": "Standard" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -186,7 +199,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-VipAvailability-threshold-Override_'), field('tags._amba-VipAvailability-threshold-Override_'), parameters('threshold'))]" } ] }, @@ -311,7 +324,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-VipAvailability-threshold-Override_'), field('tags._amba-VipAvailability-threshold-Override_'), parameters('threshold'))]" } } } diff --git a/services/Network/routeTables/Deploy-ActivityLog-RouteTable-Update.json b/services/Network/routeTables/Deploy-ActivityLog-RouteTable-Update.json index df93ee30a..38586aafc 100644 --- a/services/Network/routeTables/Deploy-ActivityLog-RouteTable-Update.json +++ b/services/Network/routeTables/Deploy-ActivityLog-RouteTable-Update.json @@ -8,7 +8,7 @@ "displayName": "Deploy Activity Log Route Table Update Alert", "description": "Policy to Deploy Activity Log Route Table Update Alert", "metadata": { - "version": "1.0.1", + "version": "1.1.0", "category": "Network", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -35,7 +35,7 @@ "displayName": "Resource Group Name", "description": "Resource group the alert is placed in" }, - "defaultValue": "AlzMonitoring-rg" + "defaultValue": "rg-amba-monitoring-001" }, "alertResourceGroupTags": { "type": "Object", @@ -44,8 +44,7 @@ "description": "Tags on the Resource group the alert is placed in" }, "defaultValue": { - "environment": "test", - "_deployed_by_amba": true + "Project": "amba-monitoring" } }, "alertResourceGroupLocation": { @@ -56,13 +55,38 @@ }, "defaultValue": "centralus" }, - "MonitorDisable": { + "effect": { "type": "String", "metadata": { "displayName": "Effect", - "description": "Tag name to disable monitoring on resource. Set to true if monitoring should be disabled" + "description": "Effect of the policy" + }, + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "defaultValue": "deployIfNotExists" + }, + "MonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name to disable monitoring. Set to true if monitoring should be disabled" }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -73,13 +97,13 @@ "equals": "Microsoft.Network/routeTables" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, "then": { - "effect": "deployIfNotExists", + "effect": "[[parameters('effect')]", "details": { "roleDefinitionIds": [ "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c" diff --git a/services/Network/trafficmanagerprofiles/Deploy-TM-EndpointHealth-Alert.json b/services/Network/trafficmanagerprofiles/Deploy-TM-EndpointHealth-Alert.json index 20046d49e..101d0651a 100644 --- a/services/Network/trafficmanagerprofiles/Deploy-TM-EndpointHealth-Alert.json +++ b/services/Network/trafficmanagerprofiles/Deploy-TM-EndpointHealth-Alert.json @@ -8,8 +8,8 @@ "displayName": "Deploy Traffic Manager Endpoint Health Alert", "description": "Policy to audit/deploy FTraffic Manager Endpoint Health Health Alert", "metadata": { - "version": "1.1.1", - "category": "Networking", + "version": "1.2.0", + "Category": "Networking", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "_deployed_by_amba": "True" }, @@ -106,13 +106,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -123,8 +136,8 @@ "equals": "Microsoft.Network/trafficmanagerprofiles" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -179,7 +192,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-EndpointHealth-threshold-Override_'), field('tags._amba-EndpointHealth-threshold-Override_'), parameters('threshold'))]" } ] }, @@ -313,7 +326,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-EndpointHealth-threshold-Override_'), field('tags._amba-EndpointHealth-threshold-Override_'), parameters('threshold'))]" } } } diff --git a/services/Network/virtualNetworkGateways/Deploy-VNETG-BandwidthUtilization-Alert.json b/services/Network/virtualNetworkGateways/Deploy-VNETG-BandwidthUtilization-Alert.json index 554b9087c..968ba9feb 100644 --- a/services/Network/virtualNetworkGateways/Deploy-VNETG-BandwidthUtilization-Alert.json +++ b/services/Network/virtualNetworkGateways/Deploy-VNETG-BandwidthUtilization-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy VNetG Tunnel Bandwidth Alert", "description": "Policy to audit/deploy Virtual Network Gateway Tunnel Bandwidth Alert", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Network", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -109,13 +109,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -130,8 +143,8 @@ "equals": "VPN" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -186,7 +199,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-TunnelAverageBandwidth-threshold-Override_'), field('tags._amba-TunnelAverageBandwidth-threshold-Override_'), parameters('threshold'))]" } ] }, @@ -256,7 +269,7 @@ "metricNamespace": "Microsoft.Network/virtualNetworkGateways", "metricName": "TunnelAverageBandwidth", "operator": "LessThan", - "threshold": "[[parameters('threshold')]", + "threshold": "[[if(contains(field('tags'), '_amba-TunnelAverageBandwidth-threshold-Override_'), field('tags._amba-TunnelAverageBandwidth-threshold-Override_'), parameters('threshold'))]", "timeAggregation": "Average", "criterionType": "StaticThresholdCriterion" } diff --git a/services/Network/virtualNetworkGateways/Deploy-VNETG-ERGBitsPerSecond-Alert.json b/services/Network/virtualNetworkGateways/Deploy-VNETG-ERGBitsPerSecond-Alert.json index 60ad1c9e1..ba52a7e25 100644 --- a/services/Network/virtualNetworkGateways/Deploy-VNETG-ERGBitsPerSecond-Alert.json +++ b/services/Network/virtualNetworkGateways/Deploy-VNETG-ERGBitsPerSecond-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy VNetG ExpressRoute Bits Per Second Alert", "description": "Policy to audit/deploy Virtual Network Gateway Express Route Bits Per Second Alert", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Network", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -109,13 +109,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -130,8 +143,8 @@ "equals": "ExpressRoute" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -186,7 +199,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-ExpressRouteGatewayBitsPerSecond-threshold-Override_'), field('tags._amba-ExpressRouteGatewayBitsPerSecond-threshold-Override_'), parameters('threshold'))]" } ] }, @@ -311,7 +324,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-ExpressRouteGatewayBitsPerSecond-threshold-Override_'), field('tags._amba-ExpressRouteGatewayBitsPerSecond-threshold-Override_'), parameters('threshold'))]" } } } diff --git a/services/Network/virtualNetworkGateways/Deploy-VNETG-ERGCPUUtilization-Alert.json b/services/Network/virtualNetworkGateways/Deploy-VNETG-ERGCPUUtilization-Alert.json index b115e8703..c63904d1b 100644 --- a/services/Network/virtualNetworkGateways/Deploy-VNETG-ERGCPUUtilization-Alert.json +++ b/services/Network/virtualNetworkGateways/Deploy-VNETG-ERGCPUUtilization-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy VNetG ExpressRoute CPU Utilization Alert", "description": "Policy to audit/deploy Virtual Network Gateway Express Route CPU Utilization Alert", "metadata": { - "version": "1.1.0", + "version": "1.2.1", "category": "Network", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -109,13 +109,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -130,8 +143,8 @@ "equals": "ExpressRoute" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -186,7 +199,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-ExpressRouteGatewayCpuUtilization-threshold-Override_'), field('tags._amba-ExpressRouteGatewayCpuUtilization-threshold-Override_'), parameters('threshold'))]" } ] }, @@ -211,6 +224,9 @@ "description": "Resource ID of the resource emitting the metric that will be used for the comparison" } }, + "severity": { + "type": "String" + }, "windowSize": { "type": "String" }, @@ -308,7 +324,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-ExpressRouteGatewayCpuUtilization-threshold-Override_'), field('tags._amba-ExpressRouteGatewayCpuUtilization-threshold-Override_'), parameters('threshold'))]" } } } diff --git a/services/Network/virtualNetworkGateways/Deploy-VNETG-Egress-Alert.json b/services/Network/virtualNetworkGateways/Deploy-VNETG-Egress-Alert.json index 739fa0cb4..949ad88ce 100644 --- a/services/Network/virtualNetworkGateways/Deploy-VNETG-Egress-Alert.json +++ b/services/Network/virtualNetworkGateways/Deploy-VNETG-Egress-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy VNetG Tunnel Egress Alert", "description": "Policy to audit/deploy Virtual Network Gateway Tunnel Egress Alert", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Network", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -109,13 +109,26 @@ ], "defaultValue": "disabled" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -130,8 +143,8 @@ "equals": "VPN" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -186,7 +199,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-TunnelEgressBytes-threshold-Override_'), field('tags._amba-TunnelEgressBytes-threshold-Override_'), parameters('threshold'))]" } ] }, @@ -311,7 +324,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-TunnelEgressBytes-threshold-Override_'), field('tags._amba-TunnelEgressBytes-threshold-Override_'), parameters('threshold'))]" } } } diff --git a/services/Network/virtualNetworkGateways/Deploy-VNETG-EgressPacketDropCount-Alert.json b/services/Network/virtualNetworkGateways/Deploy-VNETG-EgressPacketDropCount-Alert.json index 6e53968fd..ee2631a4b 100644 --- a/services/Network/virtualNetworkGateways/Deploy-VNETG-EgressPacketDropCount-Alert.json +++ b/services/Network/virtualNetworkGateways/Deploy-VNETG-EgressPacketDropCount-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy VNetG Egress Packet Drop Count Alert", "description": "Policy to audit/deploy Vnet Gateway Egress Packet Drop Count Alert", "metadata": { - "version": "1.2.0", + "version": "1.3.0", "category": "Network", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -101,13 +101,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Monitoring disabled", + "displayName": "ALZ Monitoring disabled tag name", "description": "Tag name to disable monitoring. Set to true if monitoring should be disabled" }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -122,8 +135,8 @@ "equals": "VPN" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, diff --git a/services/Network/virtualNetworkGateways/Deploy-VNETG-EgressPacketDropMismatch-Alert.json b/services/Network/virtualNetworkGateways/Deploy-VNETG-EgressPacketDropMismatch-Alert.json index 7971af082..32c8f2fa0 100644 --- a/services/Network/virtualNetworkGateways/Deploy-VNETG-EgressPacketDropMismatch-Alert.json +++ b/services/Network/virtualNetworkGateways/Deploy-VNETG-EgressPacketDropMismatch-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy VNetG Egress Packet Drop Mismatch Alert", "description": "Policy to audit/deploy Vnet Gateway Egress Packet Drop Mismatch Alert", "metadata": { - "version": "1.2.0", + "version": "1.3.0", "category": "Network", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -101,13 +101,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Monitoring disabled", + "displayName": "ALZ Monitoring disabled tag name", "description": "Tag name to disable monitoring. Set to true if monitoring should be disabled" }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -122,8 +135,8 @@ "equals": "VPN" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, diff --git a/services/Network/virtualNetworkGateways/Deploy-VNETG-Ingress-Alert.json b/services/Network/virtualNetworkGateways/Deploy-VNETG-Ingress-Alert.json index 976c4150b..fd85142d4 100644 --- a/services/Network/virtualNetworkGateways/Deploy-VNETG-Ingress-Alert.json +++ b/services/Network/virtualNetworkGateways/Deploy-VNETG-Ingress-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy VNetG Tunnel Ingress Alert", "description": "Policy to audit/deploy Virtual Network Gateway Tunnel Ingress Alert", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Network", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -109,13 +109,26 @@ ], "defaultValue": "disabled" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -130,8 +143,8 @@ "equals": "VPN" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -186,7 +199,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-TunnelIngressBytes-threshold-Override_'), field('tags._amba-TunnelIngressBytes-threshold-Override_'), parameters('threshold'))]" } ] }, @@ -311,7 +324,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-TunnelIngressBytes-threshold-Override_'), field('tags._amba-TunnelIngressBytes-threshold-Override_'), parameters('threshold'))]" } } } diff --git a/services/Network/virtualNetworkGateways/Deploy-VNETG-IngressPacketDropCount-Alert.json b/services/Network/virtualNetworkGateways/Deploy-VNETG-IngressPacketDropCount-Alert.json index 3ac49d0bc..4450e0480 100644 --- a/services/Network/virtualNetworkGateways/Deploy-VNETG-IngressPacketDropCount-Alert.json +++ b/services/Network/virtualNetworkGateways/Deploy-VNETG-IngressPacketDropCount-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy VNetG Ingress Packet Drop Count Alert", "description": "Policy to audit/deploy Vnet Gateway Ingress Packet Drop Count Alert", "metadata": { - "version": "1.2.0", + "version": "1.3.0", "category": "Network", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -101,13 +101,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Monitoring disabled", + "displayName": "ALZ Monitoring disabled tag name", "description": "Tag name to disable monitoring. Set to true if monitoring should be disabled" }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -122,8 +135,8 @@ "equals": "VPN" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, diff --git a/services/Network/virtualNetworkGateways/Deploy-VNETG-IngressPacketDropMismatch-Alert.json b/services/Network/virtualNetworkGateways/Deploy-VNETG-IngressPacketDropMismatch-Alert.json index f85d42a7d..c4a0cae8c 100644 --- a/services/Network/virtualNetworkGateways/Deploy-VNETG-IngressPacketDropMismatch-Alert.json +++ b/services/Network/virtualNetworkGateways/Deploy-VNETG-IngressPacketDropMismatch-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy VNetG Ingress Packet Drop Mismatch Alert", "description": "Policy to audit/deploy Vnet Gateway Ingress Packet Drop Mismatch Alert", "metadata": { - "version": "1.2.0", + "version": "1.3.0", "category": "Network", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -101,13 +101,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Monitoring disabled", + "displayName": "ALZ Monitoring disabled tag name", "description": "Tag name to disable monitoring. Set to true if monitoring should be disabled" }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -122,8 +135,8 @@ "equals": "VPN" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, diff --git a/services/Network/virtualNetworks/Deploy-VNET-DDOSAttack-Alert.json b/services/Network/virtualNetworks/Deploy-VNET-DDOSAttack-Alert.json index ab3b661f5..7f31d0605 100644 --- a/services/Network/virtualNetworks/Deploy-VNET-DDOSAttack-Alert.json +++ b/services/Network/virtualNetworks/Deploy-VNET-DDOSAttack-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy VNet DDoS Attack Alert", "description": "Policy to audit/deploy Virtual Network DDoS Attack Alert", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Network", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -109,13 +109,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -126,8 +139,8 @@ "equals": "Microsoft.Network/virtualNetworks" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -182,7 +195,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-ifunderddosattack-threshold-Override_'), field('tags._amba-ifunderddosattack-threshold-Override_'), parameters('threshold'))]" } ] }, @@ -307,7 +320,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-ifunderddosattack-threshold-Override_'), field('tags._amba-ifunderddosattack-threshold-Override_'), parameters('threshold'))]" } } } diff --git a/services/Network/vpnGateways/Deploy-ActivityLog-VPNG-Del.json b/services/Network/vpnGateways/Deploy-ActivityLog-VPNG-Del.json index 07d6f40c5..fa9040b08 100644 --- a/services/Network/vpnGateways/Deploy-ActivityLog-VPNG-Del.json +++ b/services/Network/vpnGateways/Deploy-ActivityLog-VPNG-Del.json @@ -8,7 +8,7 @@ "displayName": "Deploy Activity Log VPN Gateway Delete Alert", "description": "Policy to Deploy Activity Log VPN Gateway Delete Alert", "metadata": { - "version": "1.0.1", + "version": "1.1.0", "category": "Network", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -35,7 +35,7 @@ "displayName": "Resource Group Name", "description": "Resource group the alert is placed in" }, - "defaultValue": "AlzMonitoring-rg" + "defaultValue": "rg-amba-monitoring-001" }, "alertResourceGroupTags": { "type": "Object", @@ -44,8 +44,7 @@ "description": "Tags on the Resource group the alert is placed in" }, "defaultValue": { - "environment": "test", - "_deployed_by_amba": true + "Project": "amba-monitoring" } }, "alertResourceGroupLocation": { @@ -56,13 +55,38 @@ }, "defaultValue": "centralus" }, - "MonitorDisable": { + "effect": { "type": "String", "metadata": { "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "description": "Effect of the policy" + }, + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "defaultValue": "deployIfNotExists" + }, + "MonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -73,13 +97,13 @@ "equals": "Microsoft.Network/vpnGateways" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, "then": { - "effect": "deployIfNotExists", + "effect": "[[parameters('effect')]", "details": { "roleDefinitionIds": [ "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c" diff --git a/services/Network/vpnGateways/Deploy-VPNG-BGPPeerStatus-Alert.json b/services/Network/vpnGateways/Deploy-VPNG-BGPPeerStatus-Alert.json index 050211129..245b99977 100644 --- a/services/Network/vpnGateways/Deploy-VPNG-BGPPeerStatus-Alert.json +++ b/services/Network/vpnGateways/Deploy-VPNG-BGPPeerStatus-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy VPNG BGP Peer Status Alert", "description": "Policy to audit/deploy VPN Gateway BGP Peer Status Alert", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Network", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -109,13 +109,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -126,8 +139,8 @@ "equals": "microsoft.network/vpngateways" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -182,7 +195,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-bgppeerstatus-threshold-Override_'), field('tags._amba-bgppeerstatus-threshold-Override_'), parameters('threshold'))]" } ] }, @@ -307,7 +320,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-bgppeerstatus-threshold-Override_'), field('tags._amba-bgppeerstatus-threshold-Override_'), parameters('threshold'))]" } } } diff --git a/services/Network/vpnGateways/Deploy-VPNG-BandwidthUtilization-Alert.json b/services/Network/vpnGateways/Deploy-VPNG-BandwidthUtilization-Alert.json index 0f14de858..c54ee5bcd 100644 --- a/services/Network/vpnGateways/Deploy-VPNG-BandwidthUtilization-Alert.json +++ b/services/Network/vpnGateways/Deploy-VPNG-BandwidthUtilization-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy VPNG Bandwidth Utilization Alert", "description": "Policy to audit/deploy VPN Gateway Bandwidth Utilization Alert", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Network", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -109,13 +109,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -126,8 +139,8 @@ "equals": "microsoft.network/vpngateways" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -182,7 +195,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-tunnelaveragebandwidth-threshold-Override_'), field('tags._amba-tunnelaveragebandwidth-threshold-Override_'), parameters('threshold'))]" } ] }, @@ -307,7 +320,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-tunnelaveragebandwidth-threshold-Override_'), field('tags._amba-tunnelaveragebandwidth-threshold-Override_'), parameters('threshold'))]" } } } diff --git a/services/Network/vpnGateways/Deploy-VPNG-Egress-Alert.json b/services/Network/vpnGateways/Deploy-VPNG-Egress-Alert.json index a97980ef9..dbd889740 100644 --- a/services/Network/vpnGateways/Deploy-VPNG-Egress-Alert.json +++ b/services/Network/vpnGateways/Deploy-VPNG-Egress-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy VPNG Egress Alert", "description": "Policy to audit/deploy VPN Gateway Egress Alert", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Network", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -109,13 +109,26 @@ ], "defaultValue": "disabled" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -126,8 +139,8 @@ "equals": "microsoft.network/vpngateways" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -182,7 +195,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-tunnelegressbytes-threshold-Override_'), field('tags._amba-tunnelegressbytes-threshold-Override_'), parameters('threshold'))]" } ] }, @@ -307,7 +320,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-tunnelegressbytes-threshold-Override_'), field('tags._amba-tunnelegressbytes-threshold-Override_'), parameters('threshold'))]" } } } diff --git a/services/Network/vpnGateways/Deploy-VPNG-EgressPacketDropCount-Alert.json b/services/Network/vpnGateways/Deploy-VPNG-EgressPacketDropCount-Alert.json index 193896d4e..e04045226 100644 --- a/services/Network/vpnGateways/Deploy-VPNG-EgressPacketDropCount-Alert.json +++ b/services/Network/vpnGateways/Deploy-VPNG-EgressPacketDropCount-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy VPNG Egress Packet Drop Count Alert", "description": "Policy to audit/deploy VPN Gateway Egress Packet Drop Count Alert", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Network", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -101,13 +101,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -118,8 +131,8 @@ "equals": "microsoft.network/vpngateways" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, diff --git a/services/Network/vpnGateways/Deploy-VPNG-EgressPacketDropMismatch-Alert.json b/services/Network/vpnGateways/Deploy-VPNG-EgressPacketDropMismatch-Alert.json index 8bac1c5ce..f919ab8b6 100644 --- a/services/Network/vpnGateways/Deploy-VPNG-EgressPacketDropMismatch-Alert.json +++ b/services/Network/vpnGateways/Deploy-VPNG-EgressPacketDropMismatch-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy VPNG Egress Packet Drop Mismatch Alert", "description": "Policy to audit/deploy VPN Gateway Egress Packet Drop Mismatch Alert", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Network", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -101,13 +101,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -118,8 +131,8 @@ "equals": "microsoft.network/vpngateways" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, diff --git a/services/Network/vpnGateways/Deploy-VPNG-Ingress-Alert.json b/services/Network/vpnGateways/Deploy-VPNG-Ingress-Alert.json index f7ad8c88e..748b25b42 100644 --- a/services/Network/vpnGateways/Deploy-VPNG-Ingress-Alert.json +++ b/services/Network/vpnGateways/Deploy-VPNG-Ingress-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy VPNG Ingress Alert", "description": "Policy to audit/deploy VPN Gateway Ingress Alert", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Network", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -109,13 +109,26 @@ ], "defaultValue": "disabled" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -126,8 +139,8 @@ "equals": "microsoft.network/vpngateways" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -182,7 +195,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft-Azure-Monitor-SingleResourceMultipleMetricCriteria.allOf[*].threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-tunnelingressbytes-threshold-Override_'), field('tags._amba-tunnelingressbytes-threshold-Override_'), parameters('threshold'))]" } ] }, @@ -307,7 +320,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-tunnelingressbytes-threshold-Override_'), field('tags._amba-tunnelingressbytes-threshold-Override_'), parameters('threshold'))]" } } } diff --git a/services/Network/vpnGateways/Deploy-VPNG-IngressPacketDropCount-Alert.json b/services/Network/vpnGateways/Deploy-VPNG-IngressPacketDropCount-Alert.json index 7630eb103..f8c77d8d0 100644 --- a/services/Network/vpnGateways/Deploy-VPNG-IngressPacketDropCount-Alert.json +++ b/services/Network/vpnGateways/Deploy-VPNG-IngressPacketDropCount-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy VPNG Ingress Packet Drop Count Alert", "description": "Policy to audit/deploy VPN Gateway Ingress Packet Drop Count Alert", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Network", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -101,13 +101,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -118,8 +131,8 @@ "equals": "microsoft.network/vpngateways" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, diff --git a/services/Network/vpnGateways/Deploy-VPNG-IngressPacketDropMismatch-Alert.json b/services/Network/vpnGateways/Deploy-VPNG-IngressPacketDropMismatch-Alert.json index 0866f9bc3..498005e77 100644 --- a/services/Network/vpnGateways/Deploy-VPNG-IngressPacketDropMismatch-Alert.json +++ b/services/Network/vpnGateways/Deploy-VPNG-IngressPacketDropMismatch-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy VPNG Ingress Packet Drop Mismatch Alert", "description": "Policy to audit/deploy VPN Gateway Ingress Packet Drop Mismatch Alert", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Network", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -101,13 +101,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -118,8 +131,8 @@ "equals": "microsoft.network/vpngateways" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, diff --git a/services/OperationalInsights/workspaces/Deploy-ActivityLog-LAWorkspace-Del.json b/services/OperationalInsights/workspaces/Deploy-ActivityLog-LAWorkspace-Del.json index 3dbbf74c5..a1da2cdb7 100644 --- a/services/OperationalInsights/workspaces/Deploy-ActivityLog-LAWorkspace-Del.json +++ b/services/OperationalInsights/workspaces/Deploy-ActivityLog-LAWorkspace-Del.json @@ -8,7 +8,7 @@ "displayName": "Deploy Activity Log LA Workspace Delete Alert", "description": "Policy to Deploy Activity Log LA Workspace Delete Alert", "metadata": { - "version": "1.0.3", + "version": "1.1.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -55,13 +55,38 @@ }, "defaultValue": "centralus" }, - "MonitorDisable": { + "effect": { "type": "String", "metadata": { "displayName": "Effect", - "description": "Tag name to disable monitoring on resource. Set to true if monitoring should be disabled" + "description": "Effect of the policy" + }, + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "defaultValue": "deployIfNotExists" + }, + "MonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -72,13 +97,13 @@ "equals": "Microsoft.OperationalInsights/workspaces" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, "then": { - "effect": "deployIfNotExists", + "effect": "[[parameters('effect')]", "details": { "roleDefinitionIds": [ "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c" diff --git a/services/OperationalInsights/workspaces/Deploy-ActivityLog-LAWorkspace-KeyRegen.json b/services/OperationalInsights/workspaces/Deploy-ActivityLog-LAWorkspace-KeyRegen.json index 3375d7868..ecba71d5f 100644 --- a/services/OperationalInsights/workspaces/Deploy-ActivityLog-LAWorkspace-KeyRegen.json +++ b/services/OperationalInsights/workspaces/Deploy-ActivityLog-LAWorkspace-KeyRegen.json @@ -8,7 +8,7 @@ "displayName": "Deploy Activity Log LA Workspace Regenerate Key Alert", "description": "Policy to Deploy Activity Log LA Workspace Regenerate Key Alert", "metadata": { - "version": "1.0.2", + "version": "1.1.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -44,8 +44,7 @@ "description": "Tags on the Resource group the alert is placed in" }, "defaultValue": { - "environment": "test", - "_deployed_by_amba": true + "Project": "amba-monitoring" } }, "alertResourceGroupLocation": { @@ -56,13 +55,38 @@ }, "defaultValue": "centralus" }, - "MonitorDisable": { + "effect": { "type": "String", "metadata": { "displayName": "Effect", - "description": "Tag name to disable monitoring on resource. Set to true if monitoring should be disabled" + "description": "Effect of the policy" + }, + "allowedValues": [ + "deployIfNotExists", + "disabled" + ], + "defaultValue": "deployIfNotExists" + }, + "MonitorDisableTagName": { + "type": "String", + "metadata": { + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -73,13 +97,13 @@ "equals": "Microsoft.OperationalInsights/workspaces" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, "then": { - "effect": "deployIfNotExists", + "effect": "[[parameters('effect')]", "details": { "roleDefinitionIds": [ "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c" diff --git a/services/Compute/virtualMachines/Deploy-VM-HeartBeatAlertRG.json b/services/OperationalInsights/workspaces/Deploy-LAWorkspace-DailyCapLimitReached-Alert.json similarity index 53% rename from services/Compute/virtualMachines/Deploy-VM-HeartBeatAlertRG.json rename to services/OperationalInsights/workspaces/Deploy-LAWorkspace-DailyCapLimitReached-Alert.json index d3c539c34..7495fcd14 100644 --- a/services/Compute/virtualMachines/Deploy-VM-HeartBeatAlertRG.json +++ b/services/OperationalInsights/workspaces/Deploy-LAWorkspace-DailyCapLimitReached-Alert.json @@ -1,15 +1,15 @@ { "type": "Microsoft.Authorization/policyDefinitions", "apiVersion": "2021-06-01", - "name": "Deploy_VM_HeartBeat_Alert_RG", + "name": "Deploy_LAWorkspace_DailyCapLimitReached_Alert", "properties": { "policyType": "Custom", "mode": "All", - "displayName": "Deploy VM HeartBeat Alert", - "description": "Policy to audit/deploy VM HeartBeat Alert for VMs in the resource group", + "displayName": "Deploy LA Workspace Daily Cap Limit Reached Alert", + "description": "Policy to audit/deploy LA Workspace Daily Cap Limit Reached Alert", "metadata": { - "version": "1.2.0", - "category": "Compute", + "version": "1.0.0", + "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ "AzureCloud" @@ -17,6 +17,14 @@ "_deployed_by_amba": "True" }, "parameters": { + "UAMIResourceId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "The resource Id of the user assigned managed identity.", + "displayName": "User Assigned managed Identity resource Id." + } + }, "severity": { "type": "String", "metadata": { @@ -30,7 +38,7 @@ "3", "4" ], - "defaultValue": "1" + "defaultValue": "2" }, "operator": { "type": "String", @@ -38,11 +46,8 @@ "displayName": "Operator" }, "allowedValues": [ - "Equals", "GreaterThan", - "GreaterThanOrEqual", - "LessThan", - "LessThanOrEqual" + "GreaterThanOrEqual" ], "defaultValue": "GreaterThan" }, @@ -52,13 +57,9 @@ "displayName": "TimeAggregation" }, "allowedValues": [ - "Average", - "Count", - "Maximum", - "Minimum", - "Total" + "Count" ], - "defaultValue": "Average" + "defaultValue": "Count" }, "windowSize": { "type": "String", @@ -67,15 +68,21 @@ "description": "Window size for the alert" }, "allowedValues": [ + "PT1M", "PT5M", + "PT10M", "PT15M", "PT30M", + "PT45M", "PT1H", + "PT2H", + "PT3H", + "PT4H", + "PT5H", "PT6H", - "PT12H", - "PT24H" + "P1D" ], - "defaultValue": "PT15M" + "defaultValue": "P1D" }, "evaluationFrequency": { "type": "String", @@ -85,11 +92,19 @@ }, "allowedValues": [ "PT5M", + "PT10M", "PT15M", "PT30M", - "PT1H" + "PT45M", + "PT1H", + "PT2H", + "PT3H", + "PT4H", + "PT5H", + "PT6H", + "P1D" ], - "defaultValue": "PT5M" + "defaultValue": "PT1H" }, "autoMitigate": { "type": "String", @@ -103,11 +118,11 @@ ], "defaultValue": "true" }, - "autoResolve": { + "enabled": { "type": "String", "metadata": { - "displayName": "Auto Resolve", - "description": "Auto Resolve for the alert" + "displayName": "Alert State", + "description": "Alert state for the alert" }, "allowedValues": [ "true", @@ -115,33 +130,29 @@ ], "defaultValue": "true" }, - "autoResolveTime": { + "threshold": { "type": "String", "metadata": { - "displayName": "Auto Resolve", - "description": "Auto Resolve time for the alert in ISO 8601 format" + "displayName": "Threshold", + "description": "Threshold for the alert" }, - "defaultValue": "true" + "defaultValue": "0" }, - "enabled": { + "failingPeriods": { "type": "String", "metadata": { - "displayName": "Alert State", - "description": "Alert state for the alert" + "displayName": "Failing Periods", + "description": "Number of failing periods before alert is fired" }, - "allowedValues": [ - "true", - "false" - ], - "defaultValue": "true" + "defaultValue": "1" }, - "threshold": { + "evaluationPeriods": { "type": "String", "metadata": { - "displayName": "Threshold", - "description": "Threshold for the alert" + "displayName": "Evaluation Periods", + "description": "The number of aggregated lookback points." }, - "defaultValue": "10" + "defaultValue": "1" }, "effect": { "type": "String", @@ -155,13 +166,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -169,11 +193,11 @@ "allOf": [ { "field": "type", - "equals": "Microsoft.Compute/virtualMachines" + "equals": "Microsoft.OperationalInsights/workspaces" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -187,31 +211,27 @@ "existenceCondition": { "allOf": [ { - "field": "Microsoft.Insights/scheduledQueryRules/displayName", - "equals": "[[concat(resourceGroup().name, '-VMHeartBeatAlert')]" + "field": "Microsoft.Insights/scheduledQueryRules/scopes[*]", + "equals": "[[concat(subscription().id, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.OperationalInsights/workspaces/', field('fullName'))]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/scopes[*]", - "equals": "[[concat(subscription().id, '/resourceGroups/', resourceGroup().name)]" - }, - { - "field": "Microsoft.Insights/scheduledqueryrules/enabled", + "field": "Microsoft.Insights/scheduledQueryRules/enabled", "equals": "[[parameters('enabled')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/evaluationFrequency", + "field": "Microsoft.Insights/scheduledQueryRules/evaluationFrequency", "equals": "[[parameters('evaluationFrequency')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/windowSize", + "field": "Microsoft.Insights/scheduledQueryRules/windowSize", "equals": "[[parameters('windowSize')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/severity", + "field": "Microsoft.Insights/scheduledQueryRules/severity", "equals": "[[parameters('severity')]" }, { - "field": "Microsoft.Insights/scheduledqueryrules/autoMitigate", + "field": "Microsoft.Insights/scheduledQueryRules/autoMitigate", "equals": "[[parameters('autoMitigate')]" }, { @@ -228,15 +248,19 @@ }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.numberOfEvaluationPeriods", - "equals": "1" + "equals": "[[parameters('evaluationPeriods')]" }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].failingPeriods.minFailingPeriodsToAlert", - "equals": "1" + "equals": "[[parameters('failingPeriods')]" }, { "field": "Microsoft.Insights/scheduledQueryRules/criteria.allOf[*].query", - "equals": "Heartbeat| summarize TimeGenerated=max(TimeGenerated) by Computer, _ResourceId| extend Duration = datetime_diff('minute',now(),TimeGenerated)| summarize AggregatedValue = min(Duration) by Computer, bin(TimeGenerated,5m), _ResourceId" + "equals": "[[format('let excludedResources = (arg(\"\").resources | where type =~ \"Microsoft.OperationalInsights/workspaces\" | where parse_json(tostring(tags.{0})) in~ (\"{1}\") | project customerId = tostring(properties.customerId)); let workspaceResources = (arg(\"\").resources | where type =~ \"Microsoft.OperationalInsights/workspaces\" | project id, customerId = tostring(properties.customerId), workspaceName = tostring(name)); Operation | where TenantId !in~ (excludedResources) | where OperationCategory == \"Data Collection Status\" | where Detail has_any(\"RespectQuota\", \"OverQuota\") | summarize arg_max(TimeGenerated, *) by TenantId | where Detail has \"OverQuota\" | join hint.remote=left kind=inner workspaceResources on $left.TenantId == $right.customerId | project TimeGenerated, id, workspaceName, workspaceId = TenantId, Detail', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'))]" + }, + { + "field": "identity.userAssignedIdentities", + "containsKey": "[[parameters('UAMIResourceId')]" } ] }, @@ -247,6 +271,30 @@ "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { + "resourceName": { + "type": "String", + "metadata": { + "displayName": "resourceName", + "description": "Name of the resource" + } + }, + "resourceId": { + "type": "String", + "metadata": { + "displayName": "resourceId", + "description": "Resource ID of the resource emitting the metric that will be used for the comparison" + } + }, + "resourceLocation": { + "type": "String", + "metadata": { + "displayName": "resourceLocation", + "description": "Location of the resource" + } + }, + "UAMIResourceId": { + "type": "string" + }, "severity": { "type": "String" }, @@ -259,12 +307,6 @@ "autoMitigate": { "type": "String" }, - "autoResolve": { - "type": "String" - }, - "autoResolveTime": { - "type": "String" - }, "enabled": { "type": "String" }, @@ -276,6 +318,18 @@ }, "timeAggregation": { "type": "String" + }, + "failingPeriods": { + "type": "String" + }, + "evaluationPeriods": { + "type": "String" + }, + "MonitorDisableTagName": { + "type": "String" + }, + "MonitorDisableTagValues": { + "type": "Array" } }, "variables": {}, @@ -283,55 +337,56 @@ { "type": "Microsoft.Insights/scheduledQueryRules", "apiVersion": "2022-08-01-preview", - "name": "[[concat(resourceGroup().name, '-VMHeartBeatAlert')]", - "location": "[[resourceGroup().location]", + "name": "[[concat(parameters('resourceName'), '-DailyCapLimitReachedAlert')]", + "location": "[[parameters('resourceLocation')]", + "identity": { + "type": "UserAssigned", + "userAssignedIdentities": { + "[[parameters('UAMIResourceId')]": {} + } + }, "tags": { "_deployed_by_amba": true }, "properties": { - "displayName": "[[concat(resourceGroup().name, '-VMHeartBeatAlert')]", - "description": "Log Alert for Virtual Machine Heartbeat", + "displayName": "[[concat(parameters('resourceName'), '-DailyCapLimitReachedAlert')]", + "description": "Log Alert for Daily Cap Limit Reached", "severity": "[[parameters('severity')]", "enabled": "[[parameters('enabled')]", "scopes": [ - "[[resourceGroup().Id]" - ], - "targetResourceTypes": [ - "Microsoft.Compute/virtualMachines" + "[[parameters('resourceId')]" ], "evaluationFrequency": "[[parameters('evaluationFrequency')]", "windowSize": "[[parameters('windowSize')]", "criteria": { "allOf": [ { - "query": "Heartbeat| summarize TimeGenerated=max(TimeGenerated) by Computer, _ResourceId| extend Duration = datetime_diff('minute',now(),TimeGenerated)| summarize AggregatedValue = min(Duration) by Computer, bin(TimeGenerated,5m), _ResourceId", - "metricMeasureColumn": "AggregatedValue", + "query": "[[format('let excludedResources = (arg(\"\").resources | where type =~ \"Microsoft.OperationalInsights/workspaces\" | where parse_json(tostring(tags.{0})) in~ (\"{1}\") | project customerId = tostring(properties.customerId)); let workspaceResources = (arg(\"\").resources | where type =~ \"Microsoft.OperationalInsights/workspaces\" | project id, customerId = tostring(properties.customerId), workspaceName = tostring(name)); Operation | where TenantId !in~ (excludedResources) | where OperationCategory == \"Data Collection Status\" | where Detail has_any(\"RespectQuota\", \"OverQuota\") | summarize arg_max(TimeGenerated, *) by TenantId | where Detail has \"OverQuota\" | join hint.remote=left kind=inner workspaceResources on $left.TenantId == $right.customerId | project TimeGenerated, id, workspaceName, workspaceId = TenantId, Detail', parameters('MonitorDisableTagName'), join(parameters('MonitorDisableTagValues'), '\",\"'))]", "threshold": "[[parameters('threshold')]", "operator": "[[parameters('operator')]", - "resourceIdColumn": "_ResourceId", - "timeAggregation": "[[parameters('timeAggregation')]", "dimensions": [ { - "name": "Computer", + "name": "workspaceName", "operator": "Include", "values": [ "*" ] } ], + "resourceIdColumn": "id", + "timeAggregation": "[[parameters('timeAggregation')]", "failingPeriods": { - "numberOfEvaluationPeriods": 1, - "minFailingPeriodsToAlert": 1 + "numberOfEvaluationPeriods": "[[parameters('evaluationPeriods')]", + "minFailingPeriodsToAlert": "[[parameters('failingPeriods')]" } } ] }, "autoMitigate": "[[parameters('autoMitigate')]", - "ruleResolveConfiguration": { - "autoResolved": "[[parameters('autoResolve')]", - "timeToResolve": "[[parameters('autoResolveTime')]" - }, "parameters": { + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" + }, "severity": { "value": "[[parameters('severity')]" }, @@ -344,17 +399,29 @@ "autoMitigate": { "value": "[[parameters('autoMitigate')]" }, - "autoResolve": { - "value": "[[parameters('autoResolve')]" - }, - "autoResolveTime": { - "value": "[[parameters('autoResolveTime')]" - }, "enabled": { "value": "[[parameters('enabled')]" }, "threshold": { "value": "[[parameters('threshold')]" + }, + "operator": { + "value": "[[parameters('operator')]" + }, + "timeAggregation": { + "value": "[[parameters('timeAggregation')]" + }, + "failingPeriods": { + "value": "[[parameters('failingPeriods')]" + }, + "evaluationPeriods": { + "value": "[[parameters('evaluationPeriods')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('MonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('MonitorDisableTagValues')]" } } } @@ -362,6 +429,18 @@ ] }, "parameters": { + "resourceName": { + "value": "[[field('name')]" + }, + "resourceId": { + "value": "[[field('id')]" + }, + "resourceLocation": { + "value": "[[field('location')]" + }, + "UAMIResourceId": { + "value": "[[parameters('UAMIResourceId')]" + }, "severity": { "value": "[[parameters('severity')]" }, @@ -374,12 +453,6 @@ "autoMitigate": { "value": "[[parameters('autoMitigate')]" }, - "autoResolve": { - "value": "[[parameters('autoResolve')]" - }, - "autoResolveTime": { - "value": "[[parameters('autoResolveTime')]" - }, "enabled": { "value": "[[parameters('enabled')]" }, @@ -391,6 +464,18 @@ }, "timeAggregation": { "value": "[[parameters('timeAggregation')]" + }, + "failingPeriods": { + "value": "[[parameters('failingPeriods')]" + }, + "evaluationPeriods": { + "value": "[[parameters('evaluationPeriods')]" + }, + "MonitorDisableTagName": { + "value": "[[parameters('MonitorDisableTagName')]" + }, + "MonitorDisableTagValues": { + "value": "[[parameters('MonitorDisableTagValues')]" } } } diff --git a/services/RecoveryServices/vaults/Modify-RSV-BackupHealth-Alert.json b/services/RecoveryServices/vaults/Modify-RSV-BackupHealth-Alert.json index 1511c77a6..5088e4021 100644 --- a/services/RecoveryServices/vaults/Modify-RSV-BackupHealth-Alert.json +++ b/services/RecoveryServices/vaults/Modify-RSV-BackupHealth-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy RV Backup Health Monitoring Alerts", "description": "Policy to audit/update Recovery Vault Backup Health Alerting to Azure monitor alerts", "metadata": { - "version": "1.0.0", + "version": "1.1.0", "category": "Site Recovery", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -30,13 +30,26 @@ ], "defaultValue": "modify" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -47,8 +60,8 @@ "equals": "Microsoft.RecoveryServices/Vaults" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" }, { "field": "Microsoft.RecoveryServices/vaults/monitoringSettings.azureMonitorAlertSettings.alertsForAllJobFailures", diff --git a/services/Resources/subscriptions/Deploy-ActivityLog-ResourceHealth-UnHealthly-Alert.json b/services/Resources/subscriptions/Deploy-ActivityLog-ResourceHealth-UnHealthly-Alert.json index a28d1e22e..93f5fa1bd 100644 --- a/services/Resources/subscriptions/Deploy-ActivityLog-ResourceHealth-UnHealthly-Alert.json +++ b/services/Resources/subscriptions/Deploy-ActivityLog-ResourceHealth-UnHealthly-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy Resource Health Unhealthy Alert", "description": "Policy to Deploy Resource Health Unhealthy Alert", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -67,21 +67,34 @@ ], "defaultValue": "disabled" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Monitoring disabled", + "displayName": "ALZ Monitoring disabled tag name", "description": "Tag name to disable monitoring. Set to true if monitoring should be disabled" }, "defaultValue": "MonitorDisable" }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] + }, "BYOActionGroup": { - "type": "String", + "type": "array", "metadata": { - "displayName": "Customer defined Action Group Resource ID", - "description": "The Resource ID of an existing Action Group already deployed by the customer in his environment" + "displayName": "Customer defined Action Group Resource IDs", + "description": "The Resource IDs of existing Action Groups currently deployed in the environment." }, - "defaultValue": "" + "defaultValue": [] } }, "policyRule": { @@ -92,8 +105,8 @@ "equals": "Microsoft.Resources/subscriptions" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -104,7 +117,7 @@ "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c" ], "type": "Microsoft.Insights/activityLogAlerts", - "existenceScope": "resourcegroup", + "existenceScope": "resourceGroup", "resourceGroupName": "[[parameters('alertResourceGroupName')]", "deploymentScope": "subscription", "existenceCondition": { @@ -140,12 +153,12 @@ "anyOf": [ { "field": "Microsoft.Insights/ActivityLogAlerts/actions.actionGroups[*].actionGroupId", - "contains": "[[split(trim(parameters('BYOActionGroup')),',')[0]]" + "in": "[[parameters('BYOActionGroup')]" } ] } }, - "equals": 1 + "greaterOrEquals": 1 } ] } @@ -196,18 +209,17 @@ "type": "string" }, "BYOActionGroup": { - "type": "String" + "type": "array" } }, "variables": { - "varBYOActionGroups": "[[split(parameters('BYOActionGroup'), ',')]", "copy": [ { "name": "varActionGroupIds", - "count": "[[length(variables('varBYOActionGroups'))]", + "count": "[[length(parameters('BYOActionGroup'))]", "mode": "serial", "input": { - "actionGroupId": "[[trim(variables('varBYOActionGroups')[copyIndex('varActionGroupIds')])]" + "actionGroupId": "[[trim(parameters('BYOActionGroup')[copyIndex('varActionGroupIds')])]" } } ] @@ -241,7 +253,7 @@ "type": "string" }, "BYOActionGroup": { - "type": "String" + "type": "array" } }, "variables": {}, diff --git a/services/Resources/subscriptions/Deploy-ActivityLog-ServiceHealth-Health.json b/services/Resources/subscriptions/Deploy-ActivityLog-ServiceHealth-Health.json index e4484ec19..6c08b61a2 100644 --- a/services/Resources/subscriptions/Deploy-ActivityLog-ServiceHealth-Health.json +++ b/services/Resources/subscriptions/Deploy-ActivityLog-ServiceHealth-Health.json @@ -8,7 +8,7 @@ "displayName": "Deploy Service Health Advisory Alert", "description": "Policy to Deploy Service Health Advisory Alert", "metadata": { - "version": "1.2.0", + "version": "1.3.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -67,29 +67,42 @@ ], "defaultValue": "disabled" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Monitoring disabled", + "displayName": "ALZ Monitoring disabled tag name", "description": "Tag name to disable monitoring. Set to true if monitoring should be disabled" }, "defaultValue": "MonitorDisable" }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] + }, "ALZMonitorActionGroupEmail": { - "type": "String", + "type": "Array", "metadata": { "displayName": "Action Group Email Addresses", "description": "Email addresses to send alerts to" }, - "defaultValue": "" + "defaultValue": [] }, "BYOActionGroup": { - "type": "String", + "type": "array", "metadata": { - "displayName": "Customer defined Action Group Resource ID", - "description": "The Resource ID of an existing Action Group already deployed by the customer in his environment" + "displayName": "Customer defined Action Group Resource IDs", + "description": "The Resource IDs of existing Action Groups currently deployed in the environment." }, - "defaultValue": "" + "defaultValue": [] } }, "policyRule": { @@ -100,8 +113,8 @@ "equals": "Microsoft.Resources/subscriptions" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -148,12 +161,12 @@ "anyOf": [ { "field": "Microsoft.Insights/ActivityLogAlerts/actions.actionGroups[*].actionGroupId", - "contains": "[[split(trim(parameters('BYOActionGroup')),',')[0]]" + "in": "[[parameters('BYOActionGroup')]" } ] } }, - "equals": 1 + "greaterOrEquals": 1 } ] } @@ -216,21 +229,20 @@ "type": "string" }, "ALZMonitorActionGroupEmail": { - "type": "string" + "type": "Array" }, "BYOActionGroup": { - "type": "String" + "type": "array" } }, "variables": { - "varBYOActionGroups": "[[split(parameters('BYOActionGroup'), ',')]", "copy": [ { "name": "varActionGroupIds", - "count": "[[length(variables('varBYOActionGroups'))]", + "count": "[[length(parameters('BYOActionGroup'))]", "mode": "serial", "input": { - "actionGroupId": "[[trim(variables('varBYOActionGroups')[copyIndex('varActionGroupIds')])]" + "actionGroupId": "[[trim(parameters('BYOActionGroup')[copyIndex('varActionGroupIds')])]" } } ] @@ -264,10 +276,10 @@ "type": "string" }, "ALZMonitorActionGroupEmail": { - "type": "string" + "type": "Array" }, "BYOActionGroup": { - "type": "String" + "type": "array" } }, "variables": {}, diff --git a/services/Resources/subscriptions/Deploy-ActivityLog-ServiceHealth-Incident.json b/services/Resources/subscriptions/Deploy-ActivityLog-ServiceHealth-Incident.json index 717cce406..11d499ebd 100644 --- a/services/Resources/subscriptions/Deploy-ActivityLog-ServiceHealth-Incident.json +++ b/services/Resources/subscriptions/Deploy-ActivityLog-ServiceHealth-Incident.json @@ -8,7 +8,7 @@ "displayName": "Deploy Service Health Incident Alert", "description": "Policy to Deploy Service Health Incident Alert", "metadata": { - "version": "1.2.0", + "version": "1.3.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -67,29 +67,42 @@ ], "defaultValue": "disabled" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Monitoring disabled", + "displayName": "ALZ Monitoring disabled tag name", "description": "Tag name to disable monitoring. Set to true if monitoring should be disabled" }, "defaultValue": "MonitorDisable" }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] + }, "ALZMonitorActionGroupEmail": { - "type": "String", + "type": "Array", "metadata": { "displayName": "Action Group Email Addresses", "description": "Email addresses to send alerts to" }, - "defaultValue": "" + "defaultValue": [] }, "BYOActionGroup": { - "type": "String", + "type": "array", "metadata": { - "displayName": "Customer defined Action Group Resource ID", - "description": "The Resource ID of an existing Action Group already deployed by the customer in his environment" + "displayName": "Customer defined Action Group Resource IDs", + "description": "The Resource IDs of existing Action Groups currently deployed in the environment." }, - "defaultValue": "" + "defaultValue": [] } }, "policyRule": { @@ -100,8 +113,8 @@ "equals": "Microsoft.Resources/subscriptions" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -148,12 +161,12 @@ "anyOf": [ { "field": "Microsoft.Insights/ActivityLogAlerts/actions.actionGroups[*].actionGroupId", - "contains": "[[split(trim(parameters('BYOActionGroup')),',')[0]]" + "in": "[[parameters('BYOActionGroup')]" } ] } }, - "equals": 1 + "greaterOrEquals": 1 } ] } @@ -216,21 +229,20 @@ "type": "string" }, "ALZMonitorActionGroupEmail": { - "type": "string" + "type": "Array" }, "BYOActionGroup": { - "type": "String" + "type": "array" } }, "variables": { - "varBYOActionGroups": "[[split(parameters('BYOActionGroup'), ',')]", "copy": [ { "name": "varActionGroupIds", - "count": "[[length(variables('varBYOActionGroups'))]", + "count": "[[length(parameters('BYOActionGroup'))]", "mode": "serial", "input": { - "actionGroupId": "[[trim(variables('varBYOActionGroups')[copyIndex('varActionGroupIds')])]" + "actionGroupId": "[[trim(parameters('BYOActionGroup')[copyIndex('varActionGroupIds')])]" } } ] @@ -264,10 +276,10 @@ "type": "string" }, "ALZMonitorActionGroupEmail": { - "type": "string" + "type": "Array" }, "BYOActionGroup": { - "type": "String" + "type": "array" } }, "variables": {}, diff --git a/services/Resources/subscriptions/Deploy-ActivityLog-ServiceHealth-Maintenance.json b/services/Resources/subscriptions/Deploy-ActivityLog-ServiceHealth-Maintenance.json index f37a7e740..d899c74cc 100644 --- a/services/Resources/subscriptions/Deploy-ActivityLog-ServiceHealth-Maintenance.json +++ b/services/Resources/subscriptions/Deploy-ActivityLog-ServiceHealth-Maintenance.json @@ -8,7 +8,7 @@ "displayName": "Deploy Service Health Maintenance Alert", "description": "Policy to Deploy Service Health Maintenance Alert", "metadata": { - "version": "1.2.0", + "version": "1.3.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -67,29 +67,42 @@ ], "defaultValue": "disabled" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Monitoring disabled", + "displayName": "ALZ Monitoring disabled tag name", "description": "Tag name to disable monitoring. Set to true if monitoring should be disabled" }, "defaultValue": "MonitorDisable" }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] + }, "ALZMonitorActionGroupEmail": { - "type": "String", + "type": "Array", "metadata": { "displayName": "Action Group Email Addresses", "description": "Email addresses to send alerts to" }, - "defaultValue": "" + "defaultValue": [] }, "BYOActionGroup": { - "type": "String", + "type": "array", "metadata": { - "displayName": "Customer defined Action Group Resource ID", - "description": "The Resource ID of an existing Action Group already deployed by the customer in his environment" + "displayName": "Customer defined Action Group Resource IDs", + "description": "The Resource IDs of existing Action Groups currently deployed in the environment." }, - "defaultValue": "" + "defaultValue": [] } }, "policyRule": { @@ -100,8 +113,8 @@ "equals": "Microsoft.Resources/subscriptions" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -148,12 +161,12 @@ "anyOf": [ { "field": "Microsoft.Insights/ActivityLogAlerts/actions.actionGroups[*].actionGroupId", - "contains": "[[split(trim(parameters('BYOActionGroup')),',')[0]]" + "in": "[[parameters('BYOActionGroup')]" } ] } }, - "equals": 1 + "greaterOrEquals": 1 } ] } @@ -216,21 +229,20 @@ "type": "string" }, "ALZMonitorActionGroupEmail": { - "type": "string" + "type": "Array" }, "BYOActionGroup": { - "type": "String" + "type": "array" } }, "variables": { - "varBYOActionGroups": "[[split(parameters('BYOActionGroup'), ',')]", "copy": [ { "name": "varActionGroupIds", - "count": "[[length(variables('varBYOActionGroups'))]", + "count": "[[length(parameters('BYOActionGroup'))]", "mode": "serial", "input": { - "actionGroupId": "[[trim(variables('varBYOActionGroups')[copyIndex('varActionGroupIds')])]" + "actionGroupId": "[[trim(parameters('BYOActionGroup')[copyIndex('varActionGroupIds')])]" } } ] @@ -264,10 +276,10 @@ "type": "string" }, "ALZMonitorActionGroupEmail": { - "type": "string" + "type": "Array" }, "BYOActionGroup": { - "type": "String" + "type": "array" } }, "variables": {}, diff --git a/services/Resources/subscriptions/Deploy-ActivityLog-ServiceHealth-Security.json b/services/Resources/subscriptions/Deploy-ActivityLog-ServiceHealth-Security.json index f361cc28e..f7c0c1926 100644 --- a/services/Resources/subscriptions/Deploy-ActivityLog-ServiceHealth-Security.json +++ b/services/Resources/subscriptions/Deploy-ActivityLog-ServiceHealth-Security.json @@ -8,7 +8,7 @@ "displayName": "Deploy Service Health Security Advisory Alert", "description": "Policy to Deploy Service Health Security Advisory Alert", "metadata": { - "version": "1.2.0", + "version": "1.3.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -67,29 +67,42 @@ ], "defaultValue": "disabled" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Monitoring disabled", + "displayName": "ALZ Monitoring disabled tag name", "description": "Tag name to disable monitoring. Set to true if monitoring should be disabled" }, "defaultValue": "MonitorDisable" }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] + }, "ALZMonitorActionGroupEmail": { - "type": "String", + "type": "Array", "metadata": { "displayName": "Action Group Email Addresses", "description": "Email addresses to send alerts to" }, - "defaultValue": "" + "defaultValue": [] }, "BYOActionGroup": { - "type": "String", + "type": "array", "metadata": { - "displayName": "Customer defined Action Group Resource ID", - "description": "The Resource ID of an existing Action Group already deployed by the customer in his environment" + "displayName": "Customer defined Action Group Resource IDs", + "description": "The Resource IDs of existing Action Groups currently deployed in the environment." }, - "defaultValue": "" + "defaultValue": [] } }, "policyRule": { @@ -100,8 +113,8 @@ "equals": "Microsoft.Resources/subscriptions" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -148,12 +161,12 @@ "anyOf": [ { "field": "Microsoft.Insights/ActivityLogAlerts/actions.actionGroups[*].actionGroupId", - "contains": "[[split(trim(parameters('BYOActionGroup')),',')[0]]" + "in": "[[parameters('BYOActionGroup')]" } ] } }, - "equals": 1 + "greaterOrEquals": 1 } ] } @@ -216,21 +229,20 @@ "type": "string" }, "ALZMonitorActionGroupEmail": { - "type": "string" + "type": "Array" }, "BYOActionGroup": { - "type": "String" + "type": "array" } }, "variables": { - "varBYOActionGroups": "[[split(parameters('BYOActionGroup'), ',')]", "copy": [ { "name": "varActionGroupIds", - "count": "[[length(variables('varBYOActionGroups'))]", + "count": "[[length(parameters('BYOActionGroup'))]", "mode": "serial", "input": { - "actionGroupId": "[[trim(variables('varBYOActionGroups')[copyIndex('varActionGroupIds')])]" + "actionGroupId": "[[trim(parameters('BYOActionGroup')[copyIndex('varActionGroupIds')])]" } } ] @@ -264,10 +276,10 @@ "type": "string" }, "ALZMonitorActionGroupEmail": { - "type": "string" + "type": "Array" }, "BYOActionGroup": { - "type": "String" + "type": "array" } }, "variables": {}, diff --git a/services/Resources/subscriptions/Deploy-ServiceHealth-ActionGroups.json b/services/Resources/subscriptions/Deploy-ServiceHealth-ActionGroups.json index d1f09061d..26d638dfc 100644 --- a/services/Resources/subscriptions/Deploy-ServiceHealth-ActionGroups.json +++ b/services/Resources/subscriptions/Deploy-ServiceHealth-ActionGroups.json @@ -8,7 +8,7 @@ "displayName": "Deploy Service Health Action Group", "description": "Policy to deploy action group for Service Health alerts", "metadata": { - "version": "1.2.0", + "version": "1.3.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -17,14 +17,27 @@ "_deployed_by_amba": "True" }, "parameters": { - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Monitoring disabled", - "description": "Tag name to disable monitoring Subscription level alerts. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] + }, "ALZMonitorResourceGroupName": { "type": "String", "metadata": { @@ -52,12 +65,12 @@ "defaultValue": "centralus" }, "ALZMonitorActionGroupEmail": { - "type": "String", + "type": "Array", "metadata": { "displayName": "Action Group Email Addresses", "description": "Email addresses to send alerts to" }, - "defaultValue": "" + "defaultValue": [] }, "ALZLogicappResourceId": { "type": "String", @@ -76,28 +89,28 @@ "defaultValue": "" }, "ALZArmRoleId": { - "type": "String", + "type": "array", "metadata": { - "displayName": "Arm Role Id", - "description": "Arm Built-in Role Id for action group to send alerts to a subscription level, will only send to individual members of role" + "displayName": "Arm Role Ids", + "description": "Arm Built-in Role Ids for action group to send alerts to" }, - "defaultValue": "" + "defaultValue": [] }, "ALZEventHubResourceId": { - "type": "String", + "type": "array", "metadata": { - "displayName": "Event Hub resource id", - "description": "Event Hub resource id for action group to send alerts to" + "displayName": "Event Hub resource Ids", + "description": "Event Hub resource Ids for action group to send alerts to" }, - "defaultValue": "" + "defaultValue": [] }, "ALZWebhookServiceUri": { - "type": "String", + "type": "Array", "metadata": { - "displayName": "Webhook Service Uri", - "description": "Indicates the service uri of the webhook to send alerts to" + "displayName": "Webhook Service Uri(s)", + "description": "Indicates the service uri(s) of the webhook to send alerts to" }, - "defaultValue": "" + "defaultValue": [] }, "ALZFunctionResourceId": { "type": "String", @@ -116,12 +129,12 @@ "defaultValue": "" }, "BYOActionGroup": { - "type": "String", + "type": "array", "metadata": { - "displayName": "Customer defined Action Group Resource ID", - "description": "The Resource ID of an existing Action Group already deployed by the customer in his environment" + "displayName": "Customer defined Action Group Resource IDs", + "description": "The Resource IDs of existing Action Groups currently deployed in the environment." }, - "defaultValue": "" + "defaultValue": [] }, "BYOAlertProcessingRule": { "type": "String", @@ -140,8 +153,8 @@ "equals": "Microsoft.Resources/subscriptions" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" }, { "value": "[[empty(parameters('BYOActionGroup'))]", @@ -189,7 +202,7 @@ "type": "string" }, "ALZMonitorActionGroupEmail": { - "type": "string" + "type": "Array" }, "ALZLogicappResourceId": { "type": "string" @@ -198,13 +211,13 @@ "type": "String" }, "ALZArmRoleId": { - "type": "string" + "type": "array" }, "ALZEventHubResourceId": { - "type": "string" + "type": "array" }, "ALZWebhookServiceUri": { - "type": "string" + "type": "Array" }, "ALZFunctionResourceId": { "type": "string" @@ -213,17 +226,13 @@ "type": "String" }, "BYOActionGroup": { - "type": "String" + "type": "array" }, "BYOAlertProcessingRule": { "type": "String" } }, "variables": { - "varALZMonitorActionGroupEmail": "[[array(split(parameters('ALZMonitorActionGroupEmail'),','))]", - "varALZArmRoleId": "[[array(split(parameters('ALZArmRoleId'),','))]", - "varALZEventHubResourceId": "[[array(split(parameters('ALZEventHubResourceId'),','))]", - "varALZWebhookServiceUri": "[[array(split(parameters('ALZWebhookServiceUri'),','))]", "varLogicAppReceivers": [ { "name": "AlzLA-0", @@ -244,46 +253,46 @@ "copy": [ { "name": "varEmailReceivers", - "count": "[[length(variables('varALZMonitorActionGroupEmail'))]", + "count": "[[length(parameters('ALZMonitorActionGroupEmail'))]", "mode": "serial", "input": { - "name": "[[concat('AlzMail-', indexOf(variables('varALZMonitorActionGroupEmail'), variables('varALZMonitorActionGroupEmail')[copyIndex('varEmailReceivers')]))]", - "emailAddress": "[[trim(variables('varALZMonitorActionGroupEmail')[copyIndex('varEmailReceivers')])]", + "name": "[[concat('AlzMail-', indexOf(parameters('ALZMonitorActionGroupEmail'), parameters('ALZMonitorActionGroupEmail')[copyIndex('varEmailReceivers')]))]", + "emailAddress": "[[trim(parameters('ALZMonitorActionGroupEmail')[copyIndex('varEmailReceivers')])]", "useCommonSchema": true } }, { "name": "varArmRoleReceivers", - "count": "[[length(variables('varALZArmRoleId'))]", + "count": "[[length(parameters('ALZArmRoleId'))]", "mode": "serial", "input": { - "name": "[[concat('AlzARM-', indexOf(variables('varALZArmRoleId'), variables('varALZArmRoleId')[copyIndex('varArmRoleReceivers')]))]", - "roleId": "[[trim(variables('varALZArmRoleId')[copyIndex('varArmRoleReceivers')])]", + "name": "[[concat('AlzARM-', indexOf(parameters('ALZArmRoleId'), parameters('ALZArmRoleId')[copyIndex('varArmRoleReceivers')]))]", + "roleId": "[[trim(parameters('ALZArmRoleId')[copyIndex('varArmRoleReceivers')])]", "useCommonSchema": true } }, { "name": "varEventHubReceivers", - "count": "[[length(variables('varALZEventHubResourceId'))]", + "count": "[[length(parameters('ALZEventHubResourceId'))]", "mode": "serial", "input": { - "name": "[[concat('AlzEH-', indexOf(variables('varALZEventHubResourceId'), variables('varALZEventHubResourceId')[copyIndex('varEventHubReceivers')]))]", - "subscriptionId": "[[if(empty(parameters('ALZEventHubResourceId')), null(), split(trim(variables('varALZEventHubResourceId')[copyIndex('varEventHubReceivers')]),'/')[2])]", - "eventHubNameSpace": "[[if(empty(parameters('ALZEventHubResourceId')), null(), split(trim(variables('varALZEventHubResourceId')[copyIndex('varEventHubReceivers')]),'/')[8])]", - "eventHubName": "[[if(empty(parameters('ALZEventHubResourceId')), null(), split(trim(variables('varALZEventHubResourceId')[copyIndex('varEventHubReceivers')]),'/')[10])]", + "name": "[[concat('AlzEH-', indexOf(parameters('ALZEventHubResourceId'), parameters('ALZEventHubResourceId')[copyIndex('varEventHubReceivers')]))]", + "subscriptionId": "[[if(empty(parameters('ALZEventHubResourceId')), null(), split(trim(parameters('ALZEventHubResourceId')[copyIndex('varEventHubReceivers')]),'/')[2])]", + "eventHubNameSpace": "[[if(empty(parameters('ALZEventHubResourceId')), null(), split(trim(parameters('ALZEventHubResourceId')[copyIndex('varEventHubReceivers')]),'/')[8])]", + "eventHubName": "[[if(empty(parameters('ALZEventHubResourceId')), null(), split(trim(parameters('ALZEventHubResourceId')[copyIndex('varEventHubReceivers')]),'/')[10])]", "useCommonAlertSchema": true, "tenantId": "[[subscription().tenantId]" } }, { "name": "varWebhookReceivers", - "count": "[[length(variables('varALZWebhookServiceUri'))]", + "count": "[[length(parameters('ALZWebhookServiceUri'))]", "mode": "serial", "input": { - "name": "[[concat('AlzWh-', indexOf(variables('varALZWebhookServiceUri'), variables('varALZWebhookServiceUri')[copyIndex('varWebhookReceivers')]))]", + "name": "[[concat('AlzWh-', indexOf(parameters('ALZWebhookServiceUri'), parameters('ALZWebhookServiceUri')[copyIndex('varWebhookReceivers')]))]", "identifierUri": "null()", "objectId": "null()", - "serviceUri": "[[trim(variables('varALZWebhookServiceUri')[copyIndex('varWebhookReceivers')])]", + "serviceUri": "[[trim(parameters('ALZWebhookServiceUri')[copyIndex('varWebhookReceivers')])]", "useCommonAlertSchema": true, "tenantId": "null()", "useAadAuth": "false" @@ -317,7 +326,7 @@ "type": "string" }, "ALZMonitorActionGroupEmail": { - "type": "string" + "type": "Array" }, "ALZLogicappResourceId": { "type": "string" @@ -326,13 +335,13 @@ "type": "string" }, "ALZArmRoleId": { - "type": "string" + "type": "array" }, "ALZEventHubResourceId": { - "type": "string" + "type": "array" }, "ALZWebhookServiceUri": { - "type": "string" + "type": "Array" }, "ALZFunctionResourceId": { "type": "string" @@ -341,7 +350,7 @@ "type": "string" }, "BYOActionGroup": { - "type": "string" + "type": "array" }, "BYOAlertProcessingRule": { "type": "String" diff --git a/services/Storage/storageAccounts/Deploy-ActivityLog-SA-Delete-Alert.json b/services/Storage/storageAccounts/Deploy-ActivityLog-SA-Delete-Alert.json index 766402691..bbe58be65 100644 --- a/services/Storage/storageAccounts/Deploy-ActivityLog-SA-Delete-Alert.json +++ b/services/Storage/storageAccounts/Deploy-ActivityLog-SA-Delete-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy Activity Log Storage Account Delete Alert", "description": "Policy to Deploy Activity Log Storage Account Delete Alert", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Monitoring", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -67,13 +67,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Monitoring disabled", + "displayName": "ALZ Monitoring disabled tag name", "description": "Tag name to disable monitoring on resource. Set to true if monitoring should be disabled" }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -84,8 +97,8 @@ "equals": "Microsoft.Storage/storageAccounts" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, diff --git a/services/Storage/storageAccounts/Deploy-SA-Availability-Alert.json b/services/Storage/storageAccounts/Deploy-SA-Availability-Alert.json index f6048f9d7..5f0dcbf80 100644 --- a/services/Storage/storageAccounts/Deploy-SA-Availability-Alert.json +++ b/services/Storage/storageAccounts/Deploy-SA-Availability-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy SA Availability Alert", "description": "Policy to audit/deploy SA Availability Alert", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Storage", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -109,13 +109,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Monitoring disabled", + "displayName": "ALZ Monitoring disabled tag name", "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -126,8 +139,8 @@ "equals": "Microsoft.Storage/storageAccounts" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -182,7 +195,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-Availability-threshold-Override_'), field('tags._amba-Availability-threshold-Override_'), parameters('threshold'))]" } ] }, @@ -307,7 +320,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-Availability-threshold-Override_'), field('tags._amba-Availability-threshold-Override_'), parameters('threshold'))]" } } } diff --git a/services/Web/serverFarms/Deploy-WSF-CPUPercentage-Alert.json b/services/Web/serverFarms/Deploy-WSF-CPUPercentage-Alert.json index ae613b035..eb0f19fc9 100644 --- a/services/Web/serverFarms/Deploy-WSF-CPUPercentage-Alert.json +++ b/services/Web/serverFarms/Deploy-WSF-CPUPercentage-Alert.json @@ -8,8 +8,8 @@ "displayName": "Deploy App Service Plan CPU Percentage Alert", "description": "Policy to audit/deploy App Service Plan CPU Percentage Alert", "metadata": { - "version": "1.1.1", - "category": "Web Services", + "version": "1.2.0", + "Category": "Web Services", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "_deployed_by_amba": "True" }, @@ -106,13 +106,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -123,8 +136,8 @@ "equals": "Microsoft.Web/serverfarms" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -179,7 +192,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-CpuPercentage-threshold-Override_'), field('tags._amba-CpuPercentage-threshold-Override_'), parameters('threshold'))]" } ] }, @@ -304,7 +317,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-CpuPercentage-threshold-Override_'), field('tags._amba-CpuPercentage-threshold-Override_'), parameters('threshold'))]" } } } diff --git a/services/Web/serverFarms/Deploy-WSF-DiskQueueLength-Alert.json b/services/Web/serverFarms/Deploy-WSF-DiskQueueLength-Alert.json index 25df27871..1f3d33b38 100644 --- a/services/Web/serverFarms/Deploy-WSF-DiskQueueLength-Alert.json +++ b/services/Web/serverFarms/Deploy-WSF-DiskQueueLength-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy App Service Plan Disk Queue Length Alert", "description": "Policy to audit/deploy App Service Plan Disk Queue Length Alert", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Web Services", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -101,13 +101,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -118,8 +131,8 @@ "equals": "Microsoft.Web/serverfarms" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, diff --git a/services/Web/serverFarms/Deploy-WSF-HttpQueueLength-Alert.json b/services/Web/serverFarms/Deploy-WSF-HttpQueueLength-Alert.json index 4db109eae..db09ad0ad 100644 --- a/services/Web/serverFarms/Deploy-WSF-HttpQueueLength-Alert.json +++ b/services/Web/serverFarms/Deploy-WSF-HttpQueueLength-Alert.json @@ -8,7 +8,7 @@ "displayName": "Deploy App Service Plan Http Queue Length Alert", "description": "Policy to audit/deploy App Service Plan Http Queue Length Alert", "metadata": { - "version": "1.1.0", + "version": "1.2.0", "category": "Web Services", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "alzCloudEnvironments": [ @@ -101,13 +101,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -118,8 +131,8 @@ "equals": "Microsoft.Web/serverfarms" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, diff --git a/services/Web/serverFarms/Deploy-WSF-MemoryPercentage-Alert.json b/services/Web/serverFarms/Deploy-WSF-MemoryPercentage-Alert.json index a1a9c3da6..33e406a47 100644 --- a/services/Web/serverFarms/Deploy-WSF-MemoryPercentage-Alert.json +++ b/services/Web/serverFarms/Deploy-WSF-MemoryPercentage-Alert.json @@ -8,8 +8,8 @@ "displayName": "Deploy App Service Plan Memory Percentage Alert", "description": "Policy to audit/deploy App Service Plan Memory Percentage Alert", "metadata": { - "version": "1.1.1", - "category": "Web Services", + "version": "1.2.0", + "Category": "Web Services", "source": "https://github.com/Azure/azure-monitor-baseline-alerts/", "_deployed_by_amba": "True" }, @@ -106,13 +106,26 @@ ], "defaultValue": "deployIfNotExists" }, - "MonitorDisable": { + "MonitorDisableTagName": { "type": "String", "metadata": { - "displayName": "Effect", - "description": "Tag name to disable monitoring resource. Set to true if monitoring should be disabled" + "displayName": "ALZ Monitoring disabled tag name", + "description": "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." }, "defaultValue": "MonitorDisable" + }, + "MonitorDisableTagValues": { + "type": "Array", + "metadata": { + "displayName": "ALZ Monitoring disabled tag values(s)", + "description": "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." + }, + "defaultValue": [ + "true", + "Test", + "Dev", + "Sandbox" + ] } }, "policyRule": { @@ -123,8 +136,8 @@ "equals": "Microsoft.Web/serverfarms" }, { - "field": "[[concat('tags[', parameters('MonitorDisable'), ']')]", - "notEquals": "true" + "field": "[[concat('tags[', parameters('MonitorDisableTagName'), ']')]", + "notIn": "[[parameters('MonitorDisableTagValues')]" } ] }, @@ -179,7 +192,7 @@ }, { "field": "Microsoft.Insights/metricAlerts/criteria.Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria.allOf[*].StaticThresholdCriterion.threshold", - "equals": "[[parameters('threshold')]" + "equals": "[[if(contains(field('tags'), '_amba-MemoryPercentage-threshold-Override_'), field('tags._amba-MemoryPercentage-threshold-Override_'), parameters('threshold'))]" } ] }, @@ -304,7 +317,7 @@ "value": "[[parameters('enabled')]" }, "threshold": { - "value": "[[parameters('threshold')]" + "value": "[[if(contains(field('tags'), '_amba-MemoryPercentage-threshold-Override_'), field('tags._amba-MemoryPercentage-threshold-Override_'), parameters('threshold'))]" } } }